Mobile Wallet Privacy: What Three Android Wallets Send
We unzipped three Android wallets and read their manifests and code: no push SDK, no crash reporter, backup kept off the cloud — but two very different default nodes and permission sets.
Your phone holds exactly one piece of software that knows your addresses, your balance and your IP address at the same time: the wallet. Not the swap site, not the explorer — the wallet, because it holds the keys and makes the network calls. So we opened three of them. On 28 October 2026 we pulled the arm64 Android builds from each project's own GitHub release, parsed the binary AndroidManifest.xml inside every package, and searched the compiled Dart and Java code for the libraries that do the talking: push messaging, crash reporting, analytics, backup, and the default nodes a fresh install talks to.
What we opened, and what a static scan cannot tell you.
Three packages: Cake Wallet 6.5.0 (com.cakewallet.cake_wallet, versionCode 6428) at 130,627,556 bytes with 2,525 entries and 605,160,712 bytes unpacked; Monero.com 6.5.0 (com.monero.app, 6171) at 75,292,742 bytes, the same codebase with the coin list cut down; and Stack Wallet 2.7.1 (com.cypherstack.stackwallet, 2316) at 211,733,750 bytes with 639 entries and 433,735,450 bytes unpacked. Our method has hard limits and we will state them once: this is a static read of shipped builds, not a runtime capture. We can prove a library is inside the package; we cannot prove the app never phones somewhere we did not look, and we cannot see what the operator of a node or a liquidity provider keeps on the other side. Everything below is either a byte count, a manifest attribute, or a string that exists in the compiled binary — nothing is inferred from a privacy policy. (Monero wallet guide)
Leak surface one: push notifications.
All three packages came back with zero hits for firebase/messaging, FirebaseMessagingService, gcm_defaultSenderId, OneSignal, UnifiedPush and ntfy. The only notification machinery present is flutter_local_notifications, which schedules notifications on the device itself. That matters because a push token is a stable per-install identifier tied to a Google or Apple account, and the message metadata alone tells the sender when you are awake and online. Without a push SDK there is no token to leak — but there is also no way to be woken by the network, so the app has to notice things itself. That is exactly where the three builds diverge: Stack Wallet declares 10 permissions, zero services and two receivers, while Cake Wallet declares 21 permissions, 8 services and 11 receivers, including RECEIVE_BOOT_COMPLETED, WAKE_LOCK and FOREGROUND_SERVICE_DATA_SYNC. Cake keeps syncing after a reboot; Stack does not. (Monero wallet guide)
Leak surface two: crash reports and third-party SDKs.
No Crashlytics, no io/sentry, no AppsFlyer, no Adjust, no Amplitude, no Mixpanel in any of the three. Firebase appears only as three exception class names (FirebaseException, FirebaseExceptionMapper, FirebaseApiNotAvailableException) — dependency residue, not a messaging or analytics service. The differences are elsewhere: Stack Wallet contains zero com/google/android/gms strings and zero WalletConnect strings, while Cake Wallet carries Google Play services auth and credential classes (70 strings under play/core) and 88 WalletConnect strings pointing at pulse.walletconnect.org, verify.walletconnect.org and rpc.walletconnect.org. WalletConnect only fires when you open the dApp browser, but when it does, your IP reaches a relay you did not choose. A crash reporter would ship your device model, OS build and stack trace; none of these three has one in this build. (Monero wallet guide)
Leak surface three: backup.
All three set android:allowBackup="false" and android:fullBackupContent="false". That single attribute is the difference between a seed phrase that could ride along to a Google Drive backup and one that cannot: with auto-backup off, Android's cloud backup service has no claim on app data. What these wallets do instead is a password-protected file you export yourself — the strings are unambiguous (backup_service.dart, "Backup password", "Enter backup password here", "Incorrect backup password"). Note the trade-off honestly: the same flag that keeps your keys out of Google's storage also means a phone that dies without an exported backup takes the wallet with it, and a user who uploads that exported file to a cloud drive has re-created the risk the developer removed. Export to offline media, keep the password separate from the file. (seed backup guide)
Leak surface four: the node you talk to.
A fresh install resolves a default host, and that host sees your IP next to every wallet query. Cake Wallet points at node.cakewallet.com, mempool.cakewallet.com and ohttp.cakewallet.com, and resolves DNS over HTTPS against cloudflare-dns.com/dns-query and dns.google.com/resolve. Stack Wallet points at nodes.nanswap.com, chain.so, chainz.cryptoid.info, mempool.space and api.coingecko.com. Both bundle Tor: Stack ships libtor_ffi_plugin.so at 16,610,776 bytes plus a socks5_proxy package; Cake ships the torch_dart bindings and socks5_proxy as well, though no tor binary sits inside that APK, so check the in-app Tor switch rather than trusting the file list. Tor changes who sees the IP from the node operator to an exit node; DoH changes who sees the DNS query from your ISP to Cloudflare or Google. Both are improvements, neither is anonymity. Cake also embeds its swap providers in the same binary (sideShift, StealthEX, SimpleSwap, Trocador, SwapTrade, Exolix, ChangeNOW, LetsExchange), Stack embeds Exolix, Trocador, ShopInBit, WizardSwap and Nanswap — those are the parties that see your destination address and amount when you press swap. (Monero wallet guide)
Leak surface five: the permission list.
Cake Wallet declares 21 permissions against Stack Wallet's 10, and the interesting part is how the older ones are scoped. ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION, BLUETOOTH and BLUETOOTH_ADMIN all carry maxSdkVersion="30", so they only existed on Android 11 and older; WRITE_EXTERNAL_STORAGE is capped at 29. On Android 12 and newer, BLUETOOTH_SCAN is declared with usesPermissionFlags=0x10000, the neverForLocation flag — the app is telling the system its scans are not for deriving position. What remains live on a modern phone is camera, notifications, biometrics, network state, and on Cake the background trio: RECEIVE_BOOT_COMPLETED, WAKE_LOCK and an explicit REQUEST_IGNORE_BATTERY_OPTIMIZATIONS. Read that as a design choice, not a scandal: a wallet that syncs in the background will talk to a node more often, and the node sees a timestamped pattern rather than a single query. (Monero wallet guide)
What this changes for a swap.
Very little on the order form and a lot around it. An order here needs five fields — from asset, to asset, amount, destination address, refund address — and no signature; the wallet never signs anything for a swap, so the swap site's own logging policy is only half the picture (we wrote the other half separately). The half that the wallet controls is which IP arrives next to those addresses on the receiving chain, and whether a default node can see the whole balance at 09:00 and the exchange deposit address at 09:05. For scale, at 14:12 UTC on 28 October 2026 this site quoted 100 USDT-TRC20 at 0.14643508 XMR, 1,000 at 1.62493375 XMR, 1 XMR at 581.25007 USDT and 0.05 BTC at 6.64115532 XMR (132.82311 XMR per BTC), across a catalogue of 519 assets on 73 networks. Quotes move; those are a snapshot, not a promise. (recovering misdirected funds)
A five-minute check on your own phone.
You do not need our unpacking script to repeat this. Open Settings, Apps, pick the wallet, and read Permissions: anything the app asks for that is not camera, notifications and network is worth a question. Then check Settings, System, Backup and see whether the wallet appears in the auto-backup list — if it does and you do not want it there, turn the app's backup off and export a file yourself. On a computer with adb, run adb shell dumpsys package com.cakewallet.cake_wallet and grep for granted permissions to see the real state rather than the manifest's wish list; dumpsys also shows whether the app has a running foreground service. For a second opinion on trackers, the Exodus Privacy report of the same version lists embedded libraries independently of us. None of this proves server-side behaviour — only what the package contains.
The short version.
In these three builds the wallet is not the leaky part: no push token, no crash reporter, no cloud backup flag. What is left is the boring, decisive part — the default node that sees your IP and the fact that a background-syncing app produces a pattern rather than a single query. Fix that layer first: turn on the in-app Tor switch or point the wallet at a node you run, keep auto-backup off and export your own encrypted file, use one address per order, and never reuse the exchange's deposit address as a refund address. Everything above is a static read of three APKs on 28 October 2026; versions change, so re-run the check on the build you actually installed. (Is Tor safe for swaps?)