Browser extension wallet for Counterparty on Bitcoin.
- Multiple wallets and address types (SegWit, Taproot, Legacy)
- Send/receive BTC and Counterparty assets
- Create dispensers and DEX orders
- Provide liquidity to AMM pools (deposit/withdraw)
- UTXO consolidation
- Issue and manage assets
- ZELD balances and sends, and an optional, time-limited ZELD hunt when you sign a transaction
- Connect to dApps via provider API
- Marketplace signing for connected sites: listings, offers and purchases, each proved against the transaction before it is shown for approval
- Message signing: the classic signed-message format for Legacy (P2PKH) addresses, BIP-322 for SegWit and Taproot
- Hardware wallet support (Trezor)
XCP Wallet is built for Chrome (Chromium).
Trezor support uses Trezor Connect, which shows every device approval in Trezor Suite Web
(suite.trezor.io). The first time you use a Trezor, Chrome asks you to allow the wallet to access
suite.trezor.io. The wallet does not ask for it at install or update, and works without it if
you never use a Trezor.
Not yet independently audited. See AUDIT.md for our self-reported security feature checklist.
Key protections:
- AES-256-GCM encryption with PBKDF2 (600k iterations)
- Local transaction verification (detects malicious API responses)
- Audited crypto libraries (noble family, Cure53 audited)
- Minimal permissions, MV3 strict CSP, no remote code
- Hardware wallet support: private keys never leave device
Does not protect against: compromised OS, malicious extensions with higher privileges, physical access to unlocked device.
Report vulnerabilities privately through GitHub Security Advisories. The bug bounty is currently paused; see SECURITY.md for scope and what to send as an issue or pull request instead.
The wallet has 13 direct runtime dependencies, pinned to exact versions in package.json.
| Package | Purpose |
|---|---|
| @noble/curves, @noble/hashes, @scure/* | Cryptography and Bitcoin serialization |
| @trezor/connect-webextension | Hardware wallet connection |
| events | Node's EventEmitter for the browser, required by Trezor Connect 10 |
| bignumber.js | Arbitrary precision arithmetic |
| react, react-dom, react-router | UI framework |
| @headlessui/react | Accessible components |
See CONTRIBUTING.md for setup, building, testing, translations and releases, and ARCHITECTURE.md for the code map, trust boundaries, and signing lifecycle.
XCP Wallet follows the browser's language: English, Japanese, Simplified Chinese, and Traditional Chinese (Taiwan and Hong Kong). There is no language setting in the wallet; change Chrome's language to switch. Anything missing falls back to English.
The Japanese and Chinese text is machine-translated and has not yet been reviewed by native speakers. Corrections are welcome; see CONTRIBUTING.md for how to change or review a translation.
Telegram for support, feedback, and discussion.
MIT