Security, in detail

Understand your keys

Public key, private key and recovery phrase — what they are and how to protect them

PUBLIC KEY (your address) Think of it like your home address — or your mailbox. Anyone can know it: it is what you share to receive funds. Seeing your address does not let anyone touch your money, just like knowing where you live does not open your front door. Even though it does not open your home, the Arbitrum One blockchain and the Hyperliquid exchange let anyone who knows your public address look through the window and see how much USDC is in the wallet and the exchange history. So it is best to also reveal this address to as few people as possible — ideally only you and the service you use to deposit and withdraw USDC from the wallet should have access to this address.

PRIVATE KEY (the front-door key) It is the key that opens the door and proves the funds are yours. Whoever holds the private key controls the money — with no password reset and no bank to call. The app encrypts your private key on your phone (Android Keystore) and never sends it over the internet.

RECOVERY PHRASE (12 words) It is the master mold that recreates your private key on any device. With it, you can import your wallet if you need to install the app again on another phone, or take direct control of your assets using any crypto wallet.

GOOD PRACTICES 1. Write the 12 words on PAPER — never in photos, screenshots, notes apps, email, WhatsApp or cloud. Anything digital can be hacked or leaked. 2. Keep the paper in a safe, private place — ideally two copies in two different places, protected from fire and water. 3. NEVER share the phrase. No support agent, website or person will ever legitimately ask for it. Whoever asks is trying to steal from you. 4. Order matters: the words only work in the exact sequence shown. 5. Double-check each word right after writing it down — a single wrong letter makes the backup useless. 6. If possible, test the recovery on a second device before depositing large amounts. 7. Lost the phrase and lost the phone = funds lost forever. Someone found your phrase = your funds can be taken irreversibly. There is no way to reverse blockchain transactions.

IF THE APP FAILS: your funds are never trapped in the app. They live on the blockchain (Arbitrum One/Hyperliquid), not on your phone. If any feature stops working, import your recovery phrase into another wallet (e.g. MetaMask) to see and move your funds directly. To withdraw from Hyperliquid, you can also access app.hyperliquid.xyz with the same wallet. The recovery phrase is your master key — the app is just a remote control.

You are the sole custodian

Your seeds are generated on-device, encrypted with AES-256/GCM and stored in the Android Keystore. They are never sent to any server.

How your keys are protected

Derivation	BIP-44 (m/44'/60'/0'/0/0)
Encryption	AES-256 / GCM
Storage	Android Keystore
Leaves device?	Never

Android Keystore protection

The Android Keystore is a security system built into Android itself — not the app. It stores the key that encrypts your recovery phrase. The key never leaves the hardware: on devices with TEE or StrongBox, not even root can copy it. That protects the key at rest, not its use. Because the bot has to sign 24 hours a day, the key works without asking for your fingerprint — and on a rooted device any app with root permission can use that key on 0x2ALL's behalf and read your recovery phrase. Do not use 0x2ALL on a device with root or an unlocked bootloader.

Hardware-backed	When available
Key extraction	Not exportable with TEE
Availability	Android 7.0 or newer

Protection against screenshots and keyboard learning

Screenshots and screen recording are blocked on every screen of the app: a photo of the screen would come out black. And the fields where you type your recovery phrase are treated as passwords — the keyboard does not memorize these words and will never suggest them later.

Device integrity

The app checks the device itself for signs of root or an unlocked bootloader. If it finds any, it warns on launch and blocks creating a wallet, importing, on-ramping and depositing — because, with root, any app with root permission can read your recovery phrase. Withdrawing, sending and revealing the phrase stay available: the app warns and blocks the way in, never the way out.

The check is local (nothing is sent and no device identifier is read) and it is indicative: it is not proof that the device is clean.

Risk Warning

Leveraged derivatives can wipe out a position. Most retail traders lose money. Use only what you can lose without affecting your life.

Authenticity of the app

Every APK is signed with a cryptographic key that belongs to the developer. From that key comes a public value — the certificate fingerprint (SHA-256) — which identifies who signed the file. The value below is the one of the current official version:

…

Open Security → Authenticity of this app on your phone and compare the two values. If they differ, the file you received is not the official one: do not import your recovery phrase, uninstall it and download again from this site.

The fingerprint is public by design: it does not reveal the private key and gives no access to funds. It only lets you check where the file came from — the same check Android performs on every update.

Go to the download page

Updates: only the ones you choose

This app never updates itself. It does not contact any server to look for new versions, does not download APKs in the background and does not install anything without you.

The installed version only changes if you download the APK on this site's download page and install it manually over the current one. Android refuses the install if the signature is not the same — that is why the certificate fingerprint is published above.

No custody, no sign-up

We run no account server: the app asks for no email, has no login and never sees your keys. Funds and decisions remain under your exclusive control.