← Home

FAQ

Block is a non-custodial wallet. Below: how it works, what stays on your device, and why we cannot access your funds.

How it works

  1. 1.You create or import a seed phrase — it is generated in the browser.
  2. 2.The seed is encrypted with your PIN (AES-GCM) and stored locally.
  3. 3.Transactions are signed only after you unlock with your PIN — on device.
Is this a custodial wallet? Do you hold my keys?

No. Block is non-custodial: the seed is generated and encrypted on your device and never sent to the server in plaintext. We physically cannot spend your funds. An encrypted copy may sync via Telegram CloudStorage, but only your PIN can decrypt it.

Where do key operations run?

Strictly on your device, in the browser. Wallet creation, seed import, PIN unlock and transaction signing are all client-side. The server only handles public data: addresses for alerts, transaction history via Etherscan APIs, swap proxies and PassimPay invoices.

Why is Block safe?

AES-GCM with a PIN-derived key (PBKDF2, 600,000 iterations), transaction decoding before you sign, and a clear warning before moving real funds. The crypto module is open source. Block has not had a full independent audit — do not store large amounts without your own risk assessment.

Which networks are supported?

Ethereum Mainnet, Base and Arbitrum One. Base and Arbitrum are L2s with sub-cent fees, suited to smaller transfers.

How do gifts work?

Funds move to a one-time address whose key is split in two: one half in your link, one on the server. Alone they are useless, so neither Telegram nor we can claim the gift. If it is unclaimed for 7 days, you can recover the funds.

What if I lose my phone?

Restore the wallet from your seed on any device. An encrypted Telegram CloudStorage backup restores automatically for the same Telegram account — only if you also kept the seed separately.

What does site analytics see?

We use Cloudflare Web Analytics — a light, cookieless counter with no personal tracking. It shows aggregate stats only: pages, countries, devices. Seeds, PINs and private keys are never sent to analytics.