CITT

    Scan results

    Monerujo - Monero Wallet

    Android

    Monerujo is the first Android app for managing and using Monero wallets. It's a light wallet using remote nodes while keeping your private keys on your device. Supports Ledger hardware wallets, multiple wallets, Street Mode, and integrated KYC-free exchange.

    CITT SCORE
    96
    out of 100
    TRUSTED

    Quick Verdict

    Best for: Monero holders who want a self-custody wallet

    What It Means For You

    Transactions stay on the device and are broadcast directly to the Monero network. Exchange rate data is fetched from Kraken, Yadio, and the European Central Bank, and swap services are handled through Exolix. None of these services receive wallet keys or personal identity.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (2)

    Network Security

    2 total
    1 Medium
    1 Info

    Third-Party Services

    Exolix, Kraken API, Yadio, European Central Bank, Tor Project, OkHttp, NetCipher, Timber, ZXing

    Security Strengths

    • ✓Android KeyStore for hardware-backed password encryption
    • ✓Backup disabled (allowBackup="false")
    • ✓Strong TLS configuration via NetCipher
    • ✓Internal storage with MODE_PRIVATE
    • ✓No analytics or tracking SDKs
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data
    cryptocurrency

    Package

    com.m2049r.xmrwallet

    Version

    4.1.7 'Exolix'

    Analysis Date

    Mar 21, 2026

    Classes Analyzed

    4,838

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Very Secure

    Key Findings

    Data Security - 0 findings

    Network Security - 2 findings (1 medium, 1 info)

    Code Safety - 0 findings

    Privacy - 0 findings

    Privacy Concerns

    What Data is Collected

    Monerujo collects no personal data. The app operates entirely on the device. Exchange rate lookups send only a request for current pricing, with no identifying information attached.

    Third-Party Data Sharing

    Exchange rate data is fetched from Kraken, Yadio, and the European Central Bank. Swap transactions are routed through Exolix. These services receive only the data required to fulfill their function (current rates, swap amounts) and do not receive wallet keys, address history, or identity.

    Understanding the Scores

    • Security: 96/100
    • Privacy: 97/100
    • Data Security: 100/100
    • Network Security: 95/100
    • Code Safety: 100/100
    • Data Collection: 100/100
    • Data Sharing: 100/100
    • User Control: 100/100

    Positive Security Features

    • Optional Tor network routing keeps the user's IP address private when broadcasting transactions
    • No advertising or behavioral tracking libraries are present in the app
    • No personal data is collected or transmitted outside the device
    • Wallet keys remain on the device at all times and are never sent to any server

    Areas for Improvement

    • Connections to external price-fetching and swap services could use stronger transport protections to reduce the risk of data being read on untrusted networks.
    • Some network configuration settings do not apply the strongest available options, though this poses a low practical risk under typical usage conditions.

    About This Analysis

    App Details

    • App: Monerujo - Monero Wallet
    • Package: com.m2049r.xmrwallet
    • Version: 4.1.7 'Exolix'
    • Platform: Android
    • Scan Date: 2026-03-21

    Right of Reply

    Developer not yet contacted