Wallet Logo

Nuri: Bitcoin Wallet & Crypto

Latest release: 2.4.10 ( 30th June 2022 ) 🔍 Last analysed 22nd December 2021 . No source for current release found
0 ★★★★★
0 ratings
11th May 2019

Jump to verdict 

Help spread awareness for build reproducibility

Please help us spread the word discussing transparency with Nuri: Bitcoin Wallet & Crypto  via their Twitter!

Do your own research!

Try out searching for "lost bitcoins", "stole my money" or "scammers" together with the wallet's name, even if you think the wallet is generally trustworthy. For all the bigger wallets you will find accusations. Make sure you understand why they were made and if you are comfortable with the provider's reaction.

If you find something we should include, you can create an issue or edit this analysis yourself and create a merge request for your changes.

The Analysis 

(Analysis from Android review)

External Custodian

According to public information from this provider, they use an external company such as BitGo, Gemini Custody or Coinbase Custody as their custodian. Many of the products listed here do the same.

While this might be a good thing:

  • External Custodians are usually highly specialized in securing assets
  • External Custodians will care about fixing issues with one client, to not lose others
  • External Custodians are usually registered businesses under regulatory oversight
  • External Custodians will try to protect your funds even from your wallet provider: With fraud detection, they will certainly try to avoid the emptying of all users' wallets at once
it also has its down-sides:
  • External Custodians are extra intermediaries: Even when the wallet provider wants to let you use your money, they might turn out to be uncooperative
  • External Custodians holding custody of many wallets are interesting targets for hackers and thieves
  • External Custodians, being publicly registered will not be able to resist if in their jurisdiction rules on the use of Bitcoin get tightened

As External Custodians usually don't publish lists of companies they are working with and past information might be outdated, we have no way of assuring claims by wallet providers to be using their custody solution. Please let us know if you found proof that the provider is being dishonest about their business relation to External Custodians!

Updated Review and Verdict 2021-12-22

The non-custodial portion of the Nuri Banking app called the “Nuri Vault” requires that users agree to a separate agreement with BitGo, Inc.

The customer will enter into a separate agreement on the management of the private keys for the customer’s cryptocurrencies stored in a non-custodial Bitcoin wallet (the “Bitcoin Vault”). The sole parties to the latter agreement will be the customer and BitGo, Inc. (“BitGo”). The legal relationship between the investor and BitGo will be exclusively governed by the contractual terms, in particular, BitGo’s general terms and conditions , as amended from time to time (“BitGo Terms of Use”).

The BitGo Terms and Conditions:

Section 1.1

The Service requires three private cryptographic keys to be associated with each bitcoin account and BitGo controls only one of these private keys. Two of the three private keys associated with a bitcoin wallet are needed to effect a “transfer” of bitcoin from a bitcoin account (i.e., disassociate bitcoin from one bitcoin wallet and re-associate bitcoin with another bitcoin wallet).

Section 2.3

We reserve the right, to temporarily suspend or terminate your access to the Service at any time in our sole discretion, with or without cause, and with or without notice, without incurring liability of any kind.

We conversed with Nuri via twitter. We were only able to get a substantial reply via email. Here is an excerpt:

In our view, the BitGo wallets are still non-custodial. As stated in the BitGo T&Cs, their service “requires three private cryptographic keys to be associated with each bitcoin account and BitGo controls only one of these private keys”. Two of the three private keys associated with a bitcoin wallet are needed to effect a “transfer” of bitcoin from a bitcoin account (i.e., disassociate bitcoin from one bitcoin wallet and re-associate bitcoin with another bitcoin wallet). This means the BitGo private key is not needed to effect a transfer of crypto currencies. –> So irrespective of whether BitGo has suspended or terminated access to a wallet, a user can still restore the crypto standing to the account of a BitGo wallet with the other two private cryptographic keys. If you need further information how such recovery would work, please do not hesitate to ask us.

Nuri was known as bitwala prior to its re-launch. When it re-launched in 2018 as Nuri, its app and web properties also adjusted to the regulatory climate at the time. This may be the reason why Nuri identifies its GitHub repository as “Nuri (formerly bitwala)”. This is a crucial clue as Nuri does not claim to be an open source project.

Rather, despite termination provisions in its third party provider’s Terms and Conditions, it links to a way to recover the user’s Vault by linking to BitGo’s recovery application.

We were only able to locate the BitGo recovery application on GitHub, and believe that the Nuri app’s source code is not publicly available.

Previous Review 2021-08-27

From the site description:

Nuri is the app to manage, save and grow your money. Invest in cryptocurrencies, create savings plans & earn up to 5% interest per year on bitcoin directly from a German bank account.

The app is complicated as it offers both custodial and non-custodial wallets.

It identifies its non-custodial wallets as “Vaults”

The Bitcoin (BTC) VAult is available on both web and mobile devices and is a multi-signature non-custodial wallet. A multi-signature protocol, available for Bitcoin acts as a built-in additional security factor. The wallet is backed up with two seed phrases, which let you recover and access your bitcoin in case you lose access to your Nuri account. Under no circumstances, Nuri or anyone else can access or control your funds or transactions.

More information on the distinction between Nuri Wallets vs Vaults

Nuri also has a risk and disclosure page

Investors cannot verify whether Celsius Network conducts business activities that will enable it to service the claims of investors from the Bitcoin Interest Account in the future.The business activities carried out by Celsius Network may result in further risks for Nuri investors.

Identity Verification Criteria

Nuri offers the blockchain banking solution for European residents.

Resident in the European Union, A valid passport or ID card that contains the required security features, minimum age 18 years, a proof of address document (POA), in order for the account to be opened successfully, this data is verified during a video call with our partner IDnow.

(dg)

Verdict Explained

Without public source of the reviewed release available, this product cannot be verified!

As part of our Methodology, we ask:

No Source!

Is the source code publicly available?

If the answer is "no", we mark it as "No source for current release found".

A wallet that claims to not give the provider the means to steal the users’ funds might actually be lying. In the spirit of “Don’t trust - verify!” you don’t want to take the provider at his word, but trust that people hunting for fame and bug bounties could actually find flaws and back-doors in the wallet so the provider doesn’t dare to put these in.

Back-doors and flaws are frequently found in closed source products but some remain hidden for years. And even in open source security software there might be catastrophic flaws undiscovered for years.

An evil wallet provider would certainly prefer not to publish the code, as hiding it makes audits orders of magnitude harder.

For your security, you thus want the code to be available for review.

If the wallet provider doesn’t share up to date code, our analysis stops there as the wallet could steal your funds at any time, and there is no protection except the provider’s word.

“Up to date” strictly means that any instance of the product being updated without the source code being updated counts as closed source. This puts the burden on the provider to always first release the source code before releasing the product’s update. This paragraph is a clarification to our rules following a little poll.

We are not concerned about the license as long as it allows us to perform our analysis. For a security audit, it is not necessary that the provider allows others to use their code for a competing wallet. You should still prefer actual open source licenses as a competing wallet won’t use the code without giving it careful scrutiny.

The product cannot be independently verified. If the provider puts your funds at risk on purpose or by accident, you will probably not know about the issue before people start losing money. If the provider is more criminally inclined he might have collected all the backups of all the wallets, ready to be emptied at the press of a button. The product might have a formidable track record but out of distress or change in management turns out to be evil from some point on, with nobody outside ever knowing before it is too late.