Wallets & Identity / Developer Tools

In Brief

BSV Wallet’s mobile toolkit has added checks to reduce the risk of losing access to funds protected by its YubiKey Vault feature. Version 0.25.0 is published for developers, while wallet-app integration and testing of these changes with real phones and YubiKeys remain unfinished.

News Report

Published on November 14 (UTC), the update follows the project’s launch security review. Vault is designed to let a user recover protected funds with their wallet recovery phrase and any one of their registered YubiKeys—a physical security key. The changes focus on verifying those keys and checking for funds before a key can be erased or replaced.

Checking for Funds Before a Reset

On a replacement phone, local Vault records may be missing even though funds remain on BSV Blockchain. Previously, reset safeguards relied on those local records, creating a risk that a key still needed for recovery could be erased.

The updated toolkit requires a completed blockchain check before erasing or replacing the key used by Vault. It distinguishes between finding records, finding none and being unable to finish the search. A failed request, service limit or incomplete history does not count as confirmation that no funds remain.

The code also permits an explicit override acknowledging the risk of losing funds. Applications must incorporate these checks and the associated explanations into their reset screens.

Verifying Keys Before Funds Rely on Them

Vault deposits now require every key in the registered set to have been verified through interaction with the hardware or a retained record of an earlier verification. Finding a key listed in blockchain records is insufficient.

Adding another key stages it for approval; an existing verified key must authorize its activation. Restoring a Vault on a new phone also requires interaction with a registered key, rather than importing the Vault simply because its records were found.

These protections introduce an availability tradeoff. Deposits and partial withdrawals now require an online blockchain lookup. Partial withdrawals also require two verified keys because the remaining funds must be locked again. A full withdrawal is exempt from those additional restrictions, preserving an exit for someone with only one usable registered key and their recovery phrase.

Testing and App Integration

The contributor reports passing automated tests covering the new checks. The supporting review record uses simulated hardware and a test chain; testing these changes with a physical YubiKey and phone remains outstanding. Live WhatsOnChain service limits and history handling also remain unverified.

The release changes how applications must handle key enrollment, incomplete searches and recovery results. Publication of the toolkit therefore establishes developer availability, while a completed consumer-app update has not been established.

BSV TIMES Read

A hardware key is useful only if the wallet can distinguish a verified recovery route from an incomplete or misleading record. This update strengthens that distinction, particularly after a device change. Its practical value will depend on clear app behavior and successful testing with the hardware users are expected to rely on.

Developer Context

GitHub contributor sirdeggen authored the Vault changes in PR #104. The same contributor prepared the earlier mobile-toolkit recovery-progress update and iOS request fix covered by BSV TIMES on November 11.

Source Links

• Mobile wallet toolkit — npm versions and publication dates
• Mobile wallet toolkit 0.25.0 — published package record
• BSV Wallet — Vault safeguards and testing limits, PR #104
• Version 0.25.0 changelog — changed behavior and required app integration
• Vault reset checks — blockchain lookup and clearance requirements
• Vault review record — automated checks and remaining hardware limitations
• Earlier work by sirdeggen: recovery progress, PR #100, iOS request fix, PR #99

Posted on November 15, 2026 (UTC)