DigiByte Wallet v4.0.67
August 28, 2026
A small but real fix to yesterday’s passphrase feature. When you typed a recovery phrase the wallet could not accept — a mistyped word, a phrase of the wrong length — it stopped straight away, and in doing so left your passphrase sitting in the phone’s working memory instead of erasing it. Nothing was sent anywhere and nothing was written to storage, but that memory is supposed to be wiped the moment it is finished with, and on the failure paths it was not.
The fix is structural rather than a patch over each case: the passphrase is now read only after the phrase has been checked, so there is no longer any route through that code where it can be left behind. That way the next change to this function cannot quietly reintroduce it.
This release also completes a scheduled security review, run early because the passphrase work touched key derivation. The checks on the published app came back clean: no known vulnerabilities in any of its 227 software dependencies, no secrets accidentally built into the app, every network address it contains encrypted and accounted for, and the usual protections switched on in the native code.
Two findings from that review were written down rather than rushed: one about how long a passphrase lingers in memory before Android reclaims it, and one about unused code that ought to be either finished or removed. Neither can be reached by an attacker who is not already inside the app, and both are recorded publicly so they are not quietly forgotten.