GrapheneOS and NitroPhone: a secure phone for crypto

GrapheneOS strengthens your smartphone’s security, while NitroPhone comes with the system already installed. A hardware wallet stores your private keys, but your phone still gives you access to other funds and services. It may hold exchange accounts, two-factor authentication (2FA) codes, the email account you use for recovery, Telegram, and hot wallets for everyday transactions. If your phone is compromised, an attacker may only need access to your exchange account, even without your seed phrase. This guide explains which threats GrapheneOS helps protect against, where app compatibility can be a problem, and who might benefit from a NitroPhone.

Why your phone still matters when you use a hardware wallet

A hardware wallet protects the private keys you use to control your cryptocurrency. Your smartphone may still hold your exchange account, the email account used to recover it, an app with 2FA codes, a hot wallet for decentralized finance (DeFi), and conversations with counterparties about over-the-counter (OTC) trades. We explain the difference between keeping funds in your own wallet and on an exchange in our hardware wallet vs exchange comparison.

Malicious apps can make it into official app stores. In February 2025, security researchers published their findings on the SparkCat campaign: a malicious module in apps distributed through Google Play and the App Store scanned users’ photo galleries, using text recognition to find screenshots of seed phrases. According to the researchers, the infected Android apps, including the ComeCome food delivery service, had been downloaded more than 242,000 times in total. In June that year, researchers reported SparkKitty, a separate campaign in which malicious apps stole photos from users’ galleries. Details of SparkCat appear in the Securelist investigation, while SparkKitty is covered in a separate research report.

Wallets without their own screens, such as NFC cards, deserve particular attention. You see the transaction address and amount only on your phone, so if the app displays something different from what is being signed, you cannot check those details on a separate screen. Smartphone security matters even more with these wallets.

What is GrapheneOS?

GrapheneOS is an open-source operating system based on Android, with development supported by the nonprofit GrapheneOS Foundation. Its interface will feel familiar to Android users, it supports many of the same apps, and you can install Google Play if you need it. The system provides stronger memory protection, stricter app isolation, and prompt security updates; Google services are not built into it with special privileges.

GrapheneOS requires a device that allows a third-party operating system to make full use of its hardware security features. On supported Pixel phones, the Titan M2 chip limits attempts to guess your PIN. After installing GrapheneOS, you can relock the bootloader while retaining system integrity checks at startup. Pixel 8 and later models also support hardware memory tagging (MTE), which helps block attacks that exploit memory safety bugs.

As of October 1, 2026, official smartphone releases are available for supported models from the Pixel 6 through Pixel 10 generations, including the Pixel 10a. If you are buying a phone, the developers recommend Pixel 8 or newer models on their list: these have MTE and at least 7 years of support from the model’s launch date. The support remaining when you buy depends on how old the model is. For example, the minimum support period for the Pixel 6 and 6 Pro ends in October 2026, while the Pixel 10a’s runs through March 2033. The Pixel 11 is not on the current list, so check your exact model on the GrapheneOS website before ordering. The current device list and update timelines are available in the official GrapheneOS FAQ.

How GrapheneOS helps crypto users

Most security mechanisms work without additional configuration. Crypto users should also know about several features that help restrict access to data and protect a phone if it is stolen or seized. Technical details are available in the GrapheneOS features overview.

• Network access permission for each app. If a calculator, QR code scanner, or PDF viewer does not need the internet, you can disable its network access with a single toggle. The app will then behave as though there is no network connection.
• Storage Scopes and Contact Scopes. These features let you limit access to files and contacts without granting broad permission to read them. You choose which files created by other apps, folders, or contacts an app can see; files the app creates itself remain accessible to it. Without access to your entire photo gallery, an app cannot scan it the way SparkCat did.
• Separate user profiles. Each profile has its own encryption keys, apps, and data, isolated from other profiles. You can keep your main profile for everyday use and put wallets, exchange apps, and 2FA in a separate one. When you have finished, end the secondary profile’s session to remove its encryption keys from memory. You need to end the session explicitly; simply switching to another profile is not enough.
• USB-C port control. By default, a locked phone does not accept new USB data connections. If there were no existing connections, the data lines are disabled and the port is used for charging. A connection established before the phone was locked can remain active until you disconnect it. This reduces the opportunities for USB attacks used by data extraction tools.
• Auto reboot. By default, the phone reboots if it has not been unlocked for 18 hours after being locked; you can set the interval anywhere from 10 minutes to 72 hours. After a reboot, the keys needed to access encrypted user data are absent from memory until the first unlock, making that data harder to extract from a stolen or seized phone.
• Duress PIN and password. You can set a special PIN and password for use under coercion. Entering one at the corresponding device credential prompt irreversibly wipes the phone’s data and installed eSIMs. The process does not require a reboot and cannot be interrupted. To enable the feature, you must set both values: the PIN is used at PIN prompts and the password at password prompts.

Sandboxed Google Play

On GrapheneOS, you can install the official Google Play Services and Play Store as ordinary apps without system privileges. They run in a sandbox, an isolated environment with the same restrictions that apply to other apps. This provides compatibility with most apps that rely on Google services, including for push notifications. You can install Google Play only in the profile that needs it, leaving your crypto profile without it if your apps work independently of those services. Being able to download a wallet from its official website does not establish that independence: the app may still depend on Google Play Services.

Which features and apps may not work

Some familiar features and apps may become unavailable after you switch. Consider these limitations before changing your operating system.

• Pixel-specific features. Some features of the stock Pixel operating system, including call screening and certain Google AI features, may be unavailable. You can install the Pixel Camera app from the Play Store if needed.
• Contactless payments through Google Wallet. Paying with a bank card through Google Wallet is not supported on GrapheneOS because of Google’s system certification requirements. This restriction applies to Wallet payments; other compatible NFC functions remain available.
• Some banking apps. Certain banks require a Google-certified operating system and check it using Play Integrity or their own mechanisms. GrapheneOS’s stronger security does not mean it meets those requirements. Installing Google Play can provide the services an app needs, but it does not give the operating system Google certification.
• Ukrainian apps. Before switching, check the apps you actually use: monobank or another banking app, Diia, Reserve+, exchange apps, and your hardware wallet’s app. Other users’ reports may refer to a different version, so test sign-in, the operations you need, and notifications as well as whether the app opens.

Before switching, make a list of the apps you cannot do without and test each one. If a required app does not work, you can use a GrapheneOS phone as a separate device for crypto, keeping banking and government services and contactless payments on your usual smartphone.

What is NitroPhone?

NitroPhone is a Google Pixel smartphone with GrapheneOS preinstalled, sold by the German company Nitrokey. Known for its security keys and encryption hardware, Nitrokey has offered phones since 2021. You receive a device with the system already set up and support from the seller, without having to install it yourself.

Nitrokey supplies the phone in a sealed box and offers configurations with microphones, certain sensors, or cameras physically removed. Malware cannot activate a microphone that is not in the device, and you can use an external headset for calls. Confirm the configuration before ordering: once components have been removed, the manufacturer no longer claims an IP68 rating.

The NitroPhone 10a is based on the Pixel 10a. It has a Tensor G4 processor, 8 GB of RAM, a 6.3-inch OLED display with a refresh rate of up to 120 Hz, and weighs 183 g. That is enough performance for wallets, exchanges, and 2FA. The Pixel 10a’s minimum support period runs through March 2033.

You can buy the NitroPhone 10a from us with a 12-month warranty. See the product card below for the price and configuration.

The GrapheneOS project has no official partnerships with sellers of phones with the system preinstalled and recommends installing it yourself. This applies to all sellers, including Nitrokey, so when you receive a phone with GrapheneOS preinstalled, you should verify the system using the steps below.

NitroPhone 10a vs installing GrapheneOS yourself on a Pixel 10a

Both options give you the same hardware and operating system, but the installation process, purchase terms, and seller support differ.

Installing GrapheneOS yourself is free. The official web installer works in a supported browser with WebUSB, such as Chrome or Edge; you need a USB-C cable that supports data transfer to connect the phone. Read the installer’s requirements before starting, as you may need a driver or adjustments to USB access permissions. Unlocking and relocking the bootloader erase the phone’s data, so plan the installation before transferring your accounts.

If you buy a Pixel separately, check where the device came from and the seller’s warranty terms. Carrier-restricted versions, particularly those from US carriers, pose an additional risk: if the bootloader cannot be unlocked, you cannot install GrapheneOS. Before buying, confirm that OEM unlocking can be enabled in Developer options. The setting’s presence in the menu does not necessarily mean the toggle is available.

If you have a verified Pixel 8 or a newer supported model and are comfortable following the official instructions, you can install GrapheneOS yourself. The NitroPhone 10a is convenient if you want a prepared device, a warranty, and help from the seller. Whichever option you choose, verify the system before transferring your accounts.

What GrapheneOS cannot protect you from

GrapheneOS reduces risks associated with malicious apps and physical access to your phone. However, many crypto losses result from scams or unsafe storage of account credentials and wallet recovery information, which the operating system alone cannot prevent.

• Social engineering. Scammers may impersonate exchange support or “investment managers” and ask you to “verify your wallet.” If you follow their instructions, your phone’s security will not protect your funds. We discuss examples of these attacks in our article on crypto phishing.
• A seed phrase stored on your phone. Keeping it in a screenshot, note, or cloud storage is unsafe on any operating system, including GrapheneOS. We explain backup options in our guide to storing a seed phrase.
• SIM swapping. An attacker persuades your carrier to reissue your SIM card and receives your SMS codes, regardless of your phone’s operating system. To protect against this way of intercepting codes, replace SMS-based 2FA with a FIDO2 hardware security key or an authenticator app, and disable SMS as a fallback sign-in method wherever possible.
• Phishing and signing malicious transactions or permissions. If you approve a transfer or permission to spend tokens on a fake website, a secure operating system cannot undo that decision. Check the address, amount, and request details on your hardware wallet’s screen, and reject the operation if you cannot understand what you are signing. For more on checking signatures, see our guide to clear signing and blind signing.

A separate GrapheneOS phone can make sense if you hold substantial funds outside an exchange, or if you actively trade and use your phone to access exchange accounts or API keys. It may also be useful if people in the crypto community know about your holdings, as this increases the risk of targeted attacks and physical coercion. In those circumstances, auto reboot and a Duress PIN can help protect your data.

If you keep a small amount on an exchange and are just starting to improve your security, first secure your email and exchange account, replacing SMS-based 2FA wherever a more reliable alternative is available. For savings you intend to hold yourself, consider a hardware wallet. Choose a separate phone after taking these basic steps.

How to switch to GrapheneOS: a step-by-step plan

1. Decide how you will use the phone. A GrapheneOS device can be your main phone or a separate device just for crypto. The second option is simpler because it will only hold wallets, exchange apps, and 2FA, while banking and government apps stay on another phone.
2. Check the apps you need. If this will be your main phone, find out in advance whether your banking app, Diia, Reserve+, exchange apps, and hardware wallet app work on GrapheneOS.
3. Choose a compatible device. This could be a NitroPhone 10a or a Pixel 8 or newer model on the official list with an unlockable bootloader. If installing the system yourself, use the GrapheneOS web installer, follow its requirements, and make sure you complete the process by relocking the bootloader.
4. Verify the system before transferring accounts. Compare the verified boot key hash with the official value for your model by following the GrapheneOS instructions. If the seller installed the system, perform a factory reset through recovery after this check, as the project recommends. After the reset, you can set up integrity verification with Auditor: local verification requires a second Android device with the app installed, while remote verification is available through attestation.app.
5. Set up screen unlocking and backup access. Use a PIN with at least 6 random digits or a longer password, and enable PIN keypad scrambling. Before setting up the Duress PIN and password in the owner profile under Settings → Security & privacy → Device unlock → Duress Password, make sure your 2FA backup codes and any data backups you need are stored outside the phone. Both duress values must differ from your normal unlock codes and passwords.
6. Create a separate profile for crypto. Install only wallets, exchange apps, and an authenticator in that profile, using official sources. Add Google Play only to the profile that needs it for app compatibility.
7. Limit app permissions. Use Storage Scopes instead of full file access, and disable network access for apps that do not need it. If the phone is left unused for long periods, shorten the auto reboot interval.
8. Test your wallet and change your 2FA method. Connect your hardware wallet and test it with a small amount, checking the operation on its screen. Use a hardware security key wherever the service supports FIDO2; otherwise, replace SMS codes with an authenticator app. Test the new sign-in method and save your backup codes before removing the old one. After switching, disable any unnecessary SMS sign-in and account recovery options if the service allows it. Authenticator codes can also be stolen through phishing, so do not enter them on a page opened from a suspicious message. We explain the difference between codes and hardware keys in our FIDO2 guide.

Summary

GrapheneOS strengthens the security of the smartphone you use to manage exchange accounts, 2FA codes, and hot wallets. When choosing a device, check official model support, the update timeline, and compatibility with the apps you need. A Pixel running GrapheneOS and a NitroPhone based on the same model can provide the same system security; the extra cost of a NitroPhone covers device preparation, service, and purchase terms. Verify the system before transferring your accounts, then keep seed phrases offline and check the details of every operation before signing.