Your keys, verifiably yours.
Near Wallet is non-custodial by design. The team behind it cannot freeze, recover, or access your funds — and the code that proves it is on GitHub.
How the security model works.
Local key generation
An ed25519 key pair is generated with the Web Crypto API. Stored encrypted in your browser's localStorage with PBKDF2-derived AES-GCM.
Password-encrypted vault
Your password never leaves the device. The wallet derives the encryption key from it on every unlock.
Optional multisig
Accounts can deploy a 2-of-3 multisig contract. Once enabled, no single key can move funds alone.
Function-call keys
Restrict dApp permissions to a single contract & method. Revoke from the wallet UI in one click.
Open-source, independently reviewed.
Report a bug. Get paid.
The NEAR ecosystem runs an active bug bounty program through HackenProof and direct disclosure to the wallet maintainers.
| Severity | Example | Reward |
|---|---|---|
| Critical | Remote key extraction · arbitrary tx signing | up to $150,000 |
| High | Privilege escalation · session hijack | up to $30,000 |
| Medium | XSS in wallet UI · phishing surface | up to $5,000 |
| Low | UX flaw with security impact | up to $1,000 |
Reward ranges are illustrative for an educational demo and based on typical Web3 wallet bounty structures.
We secure the code. You secure the seed.
- Write your 12-word seed on paper. Store it offline.
- Use a strong password — never reuse it elsewhere.
- Connect a Ledger for any account holding meaningful funds.
- Always verify the URL — Near Wallet.com only.