Cake Wallet Review

Cake began as a Monero wallet for iOS in 2018. Its founder, Vikrant Sharma, remains identified as CEO on the company's website. Cake Labs publishes the software, while the Apple listing names Cake Technologies, LLC as seller.

The multicurrency Cake Wallet is distinct from the team's Monero.com app, which is Monero-only. Cake's public repository covers both products. Use the download links from the official site so a similarly named app does not become your starting point.

Cake is a self-custody wallet with separate per-chain wallets and optional BIP39 groups. Each setup needs its own recovery material, which the user must safeguard.

A software wallet created in Cake keeps signing authority with the user. The company cannot restore a missing seed or reverse an ordinary blockchain payment. Connecting a supported hardware wallet changes where signing happens: the external device approves transactions while Cake provides the interface.

PIN and biometric access protect the app on your device. Optional Cake 2FA adds a local time-based code, but Cake explicitly warns that this is not conventional server-enforced account security. It can deter casual access, not reliably stop a sophisticated attacker who obtains wallet files. A stolen seed also bypasses those app controls.

Public Code Is Not a Whole-App Security Certificate

Cake publishes its repository under an MIT license for public inspection. Confirming that a store download matches the published code requires a separate reproducible-build check.

Inference's December 20, 2021 audit examined threshold-signature changes in a Thorchain fork of Monero. It reported two potential security issues and five other observations. That is a real external assessment with a narrow scope, not an audit of the complete current Cake app.

WalletScrutiny's mobile page lists self-custody and public source code. When checked on September 13, 2026, its current build-verification section displayed no version-specific result. Current app-store binary matching remains unverified by that displayed section.

The Older Bitcoin Seed Flaw Still Matters

In May 2021, Cake disclosed insufficient randomness in its older 12-word Bitcoin seed generation. The fix introduced in version 4.1.7 required users to create new Bitcoin wallets and move their funds. Updating the app alone did not make an already weak seed safe. Cake said Monero wallets were outside that flaw's scope.

Independent Milk Sad research later documented the weak keys and their continuing use. Its October 2024 analysis measured 548.9 BTC moving through affected wallets over several years, not 548.9 BTC confirmed stolen. Anyone still using a Bitcoin wallet generated by an affected old Cake version should follow the migration warning rather than restore that same vulnerable seed and assume the update solved it.

September 2026 EVM Payment Fix

The September 4, 2026 advisory credits researcher Swaplane with reporting a different problem: a payment link's intended EVM network could be lost before the send screen. A user could then confirm a payment on the currently selected, incorrect network.

The advisory lists versions 6.1.2 through 6.3.0 as affected and 6.4.4 as patched. Cake's 6.4.4 release notes confirm the fix. The research examined source code without broadcasting a transaction. Install a current fixed release and still check the network, asset and destination before approving a payment request.

Cake's current documentation lists 16 chains: Monero, Bitcoin, Litecoin, Bitcoin Cash, Dogecoin, Ethereum, Polygon, Arbitrum, Base, BNB Smart Chain, Solana, TRON, Nano, Zano, Decred and Zcash. Token support includes ERC-20, BEP-20, SPL and TRC-20 assets on the appropriate networks.

The Ethereum wallet sends on Ethereum, while Base and the other EVM chains have separate wallet types. Matching address formats are not proof that a deposit is on the correct network.

For Monero, Cake supports subaddresses and accounts. Restore-height selection controls how far back the wallet scans, while custom nodes let you choose the server it connects to.

Existing Wownero wallets retain a view of their seed and keys for recovery in another app, but Cake has stopped creating new Wownero wallets. Haven has been removed.

Cake displays Ethereum NFTs but cannot send them. Solana NFTs can be sent, and SOL is needed for the transaction fee and any required recipient token-account creation. Imported entries are checked against on-chain ownership, with unowned items marked as view-only.

The currency and seed type chosen in Cake determine the recovery material, with Monero defaulting to a 16-word Polyseed. After an official download and access-protection setup, Cake shows the seed and asks you to verify selected words. Its private backup belongs somewhere separate from the protected device.

A wallet group can share a seed across eligible currencies only when the wallets use BIP39. Default Polyseed and legacy 25-word Monero wallets cannot join that group. Choosing a common seed reduces the number of backups, but also means its exposure puts every wallet in the group at risk.

An optional passphrase creates a different wallet. Recovery then requires both the seed and that passphrase. A complete backup record identifies the currencies and seed types associated with it.

Cake can also export an encrypted backup of its wallets and settings, protected by a generated backup password. Keeping that password separately and retaining the individual seeds provides both file-based and seed-based recovery options. The documented file-restore process requires a fresh installation without existing wallets. Check backup completeness while the working installation is still available.

A restored Monero wallet may show an incomplete balance while it scans. An excessively late restore height can also hide earlier transactions. The displayed balance depends on completing synchronization from an appropriate restore date. A date before the first deposit scans more history, at the cost of a longer wait.

The current supported platform list is iOS, Android, macOS and Linux. Cake's current FAQ says Windows builds are paused during a desktop overhaul. Windows users need another supported device for a current release.

Privacy Controls Have Different Jobs

Built-in Tor can hide your IP address from services contacted through it. Cake still labels the feature experimental and says some connection types are not covered. Public blockchain history remains visible regardless of IP routing. Tor can also slow synchronization or prevent a partner service from loading.

Bitcoin Silent Payments allow a reusable payment identifier while generating different on-chain destinations. Receiving requires scanning, which consumes time, battery and data. If the selected node cannot provide the required scan data, Cake uses its own server for that scanning without changing the displayed node setting. Running a custom node is therefore not enough by itself to keep that traffic on your own infrastructure.

Litecoin MWEB is available on iOS and Android. Its private balance is shown separately, and moving between ordinary Litecoin and MWEB requires confirmations. Check which balance and address type you are using before interpreting a delay as a failed payment.

Bitcoin Lightning Through Spark

Cake's Lightning integration uses Spark through the Breez SDK. The balance is held on Spark, separate from on-chain Bitcoin, and the feature is documented for mobile and macOS, but not Linux or Windows. Funding or withdrawing that balance requires a transfer between the networks.

Cake documents six confirmations when transferring between its on-chain and Lightning balances. Spark's technical documentation explains that losing the network's signing services can halt off-chain payments. Users can still exit to Bitcoin through a timed withdrawal process. A separate Spark balance should not be treated as ordinary BTC already settled to your on-chain address.

Hardware Wallet Support

Cake's guide allows USB or Bluetooth on Android, macOS and Linux, but iOS hardware connections are Bluetooth-only. The chosen model must support the intended connection. The guide still marks SeedSigner, Keystone and Foundation Passport as coming soon.

For a hardware-backed setup, keep the device's seed out of the software app and approve the transaction on the signer. Importing its recovery phrase as a software wallet would put those signing keys on the connected phone or computer.

Swaps, Purchases and dApps

Cake offers quotes through external services and protocols, including Trocador, Chainflip, Jupiter and NEAR Intents. Availability depends on the pair and network. The best-rate comparison is limited to providers available within Cake. For a delayed swap, retain the Swap ID and use Cake's support channel to trace the provider's transaction. Support cannot independently reverse a completed exchange.

The wallet itself needs no identity account. ChangeNOW's July 2026 policy, for example, allows identity checks and transaction holds, including mandatory checks for some jurisdictions. Account-free wallet creation is not a promise that every swap will avoid KYC.

Fiat purchases use partners such as Onramper, MoonPay, DFX and Robinhood Connect. Payment methods, regional eligibility and the final amount depend on the selected provider.

Cake Pay sells gift and prepaid cards using crypto. It has a separate email sign-in, and the redemption country affects the catalog. Cake Pay presents cards at face value, while its fee FAQ notes a conversion charge. The invoice gives the crypto amount due, including conversion pricing.

Cake's release notes document WalletConnect for connecting the app to dApps. Cake also documented an Ethereum-based dEURO savings feature in 2025. That feature was a token savings module, separate from native staking.

The app is free to download. Cake says it adds no fee for ordinary sending or receiving, but network charges still apply where the chain requires them. Nano transfers carry no network fee.

Floating swap quotes can change before execution. Fixed quotes have their own expiry and deposit conditions. Compare the amount delivered after charges, not just a displayed percentage. Keep enough of the appropriate network asset to send tokens: ETH pays Ethereum gas and SOL pays Solana transaction fees.

Cake is worth considering if your payments include XMR and you want control over nodes, backups and transaction settings.

• Consider it for Monero payments alongside other supported assets.
• Consider it when a documented hardware pairing matches your device and coin.
• Choose another setup if you need account-based recovery after losing all wallet secrets.
• Check alternatives if current Windows support is essential.

If you are also considering Exodus, compare its recovery arrangements with Cake's separate wallet seeds and BIP39-only groups. In Cake, choosing default Monero Polyseed leaves that wallet with its own backup, even when other assets share a group.