Most wallets only know how to say yes.
A wallet's job is to sign what it is handed. Fexr's is built around the opposite question: what should it refuse. Six checks run before every send, a two-signal filter grades tokens offline, and your key can be derived from a FIDO2 security key that keeps no seed at rest.
Put your Fexr wallet to work
Your self-custody wallet is the base. These are the individual products that trade on top of it.
Your key can live on a security key, and nowhere else
Plug in or tap a FIDO2 authenticator and the wallet derives itself from that key's PRF output. HKDF-SHA256 turns the output into 32 bytes of entropy, the entropy becomes a 24-word BIP39 phrase, and the phrase derives every chain key. Each intermediate is zeroed the moment it has been used, and the phrase itself is zeroed when you unplug the key or move the app to the background. Nothing is written to disk. Tap the same key again and the identical wallet comes back, because the salt is fixed and the only secret is a private key inside the authenticator that cannot be extracted.
Device secure element
Key bytes sit in the iOS Keychain behind user presence, or AES-wrapped by an Android Keystore key that requires recent biometric auth.
Secure Enclave · StrongBoxFIDO2 security key
Over USB-C, or an NFC tap framed as ISO 7816-4 APDUs. The transport closes as soon as the keys are in memory, so a tap is enough.
hmac-secret · PRFTwenty-four words
A standard BIP39 phrase, restorable on any device. The screen that shows it runs behind capture guards on both platforms.
BIP39 · 24 wordsEvery signature passes a gate
Three independent mechanisms stand between a request and a signed transaction, arranged so that defeating one is not enough on its own.
A token copied off the device is inert. Replaying it needs a signature from a secure element that never leaves the phone.
It reads the address before you do
Six checks run on every send and on every WalletConnect approval sheet, across three severities: info annotates, warning cautions, critical blocks. All of it is offline and deterministic apart from one optional contract-code probe, and a probe that fails never blocks a send.
Looks like a past address. This closely matches your saved contact but is not the same address, a common scam. Sending stays blocked until you confirm every character.
The recipient closely matches an address you have used before, but is not it. The dust-and-wait attack, caught by comparison against your own history.
Calldata is decoded before you sign. An unlimited allowance or a blanket NFT approval is flagged, and rated critical when the spender is not one you know.
Sending a token to its own contract address is blocked outright, because those funds are usually gone. Sending to any other contract is a warning, not a block.
The clipboard changed to a different valid address after you pasted. That is exactly what a clipboard hijacker looks like from inside the app.
You have never paid this address before. Quiet on its own, useful next to an amount you were not expecting to send.
You have, and here is the name you saved it under. The value of this line is that its absence tells you something.
Counterfeit tokens do not get a row
An airdropped fake is the cheapest way to turn a wallet's own token list against its owner. Fexr grades every token before it renders, with no network call at all, so the check still works offline and cannot be softened by a server having a bad day.
Symbol "USDC", but this is not the official USDC contract on Arbitrum. Collapsed out of the list.
The symbol uses look-alike characters. Stays visible, but wearing a badge.
A symbol matching a blue chip, or a chain's native coin, at a contract that is not the canonical one for that chain. Precise enough to grade scam and collapse the row out of the list.
Embedded links and claim-style lures, non-ASCII look-alikes, zero-width and right-to-left control characters, emoji, over-long names. Fuzzy, so it tops out at suspicious.
Trust anyway and Hide are stored per token and always beat the computed verdict, checked before the cache so the change takes effect immediately.
A permission with a ceiling and an expiry
Trading is the one thing the wallet delegates, and it delegates it narrowly. A separate agent key gets a spending cap in dollars. It can open and close positions inside that cap and it can do nothing else: withdrawals return to your own address, because the destination is not a field anyone can set. One call revokes the whole thing.
An autonomous session adds its own floor: it exits on its own when the loss threshold is hit, without waiting to be told. The strategies it can draw on live on the Copy Strategies page, and the assistant that turns plain English into orders lives on the Trading Agent page.
Twenty-nine networks from one phrase
Two curve families, eight signer implementations, one seed. Eight chains are derived the moment you create a wallet and the rest are opt-in, so a new wallet does not generate a pile of addresses you will never use. A ninth signer handles Hyperliquid order signing.
USDC in, USDC out, no approve transaction
Funding trading collateral normally costs two transactions: approve, then deposit. Fexr signs an EIP-2612 permit instead. A permit is a signature rather than a transaction, so there is no second gas payment and no standing allowance left behind on the chain afterwards.
Holding the wrong asset on the wrong chain is handled the same way. Cross-chain routing runs through a bridge aggregator behind a single quote, so the deposit path stays one screen rather than four.
Your history does not run through our servers
On-chain history is read straight from public explorers and RPC endpoints. No backend in the path and no API keys to expire. Confirmed transactions are immutable, so they are cached permanently and each refresh asks only for what is newer than the cursor the cache already knows.
Exports carry twelve columns, from date and type through to hash, counterparties and network, and they are built on a background thread so a long history never freezes the app while it writes.
Against the wallets you are actually choosing between
Not against a strawman. A good self-custody wallet earns most of these rows, and an exchange app earns some. The point is which ones it cannot.
| Capability | Fexr | Typical self-custody wallet | Exchange app |
|---|---|---|---|
| You hold the keys | Always | Always | They do |
| Key derived from a FIDO2 security key | USB-C or NFC | Separate device | No |
| Seed can exist nowhere at rest | Optional | Always stored | Not applicable |
| Biometric gate on each signature | 60-second grace | Often per session | Per session |
| Address-poisoning check before send | Blocks | Some warn | Not applicable |
| Unlimited approval decoded before signing | Blocks | Some warn | Not applicable |
| Counterfeit-token filter that works offline | Two signals | Server lists | Curated listings |
| Screen-capture guards on secrets | Both platforms | Usually Android | Not applicable |
| Session cryptographically bound to the device | DPoP | Rare | Varies |
| Delegated trading under a cap you set | Cap and expiry | No | API keys |
| History readable without vendor servers | Public sources | Vendor indexer | Vendor only |
| Exportable record for tax or audit | CSV and PDF | Varies | CSV |
The questions that actually get asked
Do I need a security key to use the wallet?
No. It is one of three places a key can live. Without one you get a standard 24-word wallet with keys held in your device's secure element, and every other protection on this page still applies.
What if I lose the security key?
The seed is derived from that specific authenticator, so a different key produces a different wallet. Back up the recovery phrase when you set up: it restores the same addresses on any device, with or without the key in hand.
Can I turn the safety checks off?
Yes. Pre-send checks, counterfeit-token detection and screen-capture guards each have their own toggle in Settings. All three ship on, and with them off the wallet behaves like any other.
What does Fexr's backend actually see?
Trading, signals and strategies go through the API under a device-bound session. On-chain balances and transaction history do not: those are read directly from public RPCs and explorers by your device.
Do I have to verify my identity?
Creating a wallet needs no account and no identity check. Some vault features and regulated flows do ask for verification, but holding, sending and receiving never do.
Are there fees?
The app is free. Moving anything on-chain costs that network's gas. Trading fees are set by the venue, and any builder fee is shown to you as a rate on the permission before you grant it.
Get the wallet
Free on both stores, set up in a couple of minutes, with or without a security key.
- Cold Wallets — how hardware custody compares
- Trading Agent — plain English in, confirmed orders out
- Copy Strategies — leaderboards and templates with backtests
- Market Signals — pay-per-query intelligence from $0.50