Cypherbox Wallet - self-custody, lightning, mobile

[cygan]

in this thread, i’d like to introduce you to the new Cypherbox wallet. i’d also like this thread to serve as a place for discussion.
developed by Strike, this mobile wallet is available for all ios and android devices. the current version 0.0.8 includes the following features:

• login to Strike via oauth 2.0
• face/touch id for coinos
• push notifications for coinos and hot/cold vaults

https://cypherbox.io/
https://github.com/CypherBoxLLC/Cypher-Box/releases/tag/v0.0.8

[dkbit98]

Latest version is 0.0.8 ... sorry but this is still early alpha version, and I would not recommend this wallet, except for testing.
I don't like messing around with lightning network, so I am not really interested in testing Cypherbox.
Another more thing users should pay attention on, they are not custodial wallet, but they connect with other custodians 

Is Cypher Box a custodial or a self-custodial wallet?

Cypher Box is not a custodian. It provides a 3rd party API connection with  Lightning custodian. It also contains self-custodial storage modules (Vaults). You can withdraw to your self-custodial Vaults upon reaching an economic Withdrawal Threshold.

[Mia Chloe]

Latest version is 0.0.8 ... sorry but this is still early alpha version, and I would not recommend this wallet, except for testing.
I don't like messing around with lightning network, so I am not really interested in testing Cypherbox.
Another more thing users should pay attention on, they are not custodial wallet, but they connect with other custodians 

Using a wallet in its say beta stage for example actually comes with some risks except you are actually willing to ignore them. Personally I have had this doubt on how far the lightning network would go and it kinda even increased when we had a drastic drop in fees recently.

As for their relation to custodian wallets, I noticed most wallets with extra features including some like cake have some closed source areas like for swaps and exchange.

[internetional]

Is Cypher Box a custodial or a self-custodial wallet?

Cypher Box is not a custodian. It provides a 3rd party API connection with  Lightning custodian. It also contains self-custodial storage modules (Vaults). You can withdraw to your self-custodial Vaults upon reaching an economic Withdrawal Threshold.

Am I correct in understanding that the self-custodial Vaults are not Lightning Network payment channels, and that moving to self-custody would require transferring the bitcoins to the base layer? And that the only way to send or receive via Lightning in this wallet is by handing control of the bitcoins over to a custodian?

[satscraper]

Is Cypher Box a custodial or a self-custodial wallet?

Cypher Box is not a custodian. It provides a 3rd party API connection with  Lightning custodian. It also contains self-custodial storage modules (Vaults). You can withdraw to your self-custodial Vaults upon reaching an economic Withdrawal Threshold.

Am I correct in understanding that the self-custodial Vaults are not Lightning Network payment channels,

Yeah, it seems you’re right. Both vaults don’t use LN channels, probably because Cypher Box relies solely on the custodial Lightning channel, while they wanted Vaults to remain strictly self‑custodial. I think that if they had their own LN node, they could make the Vaults use Lightning while still keeping them self‑custodial. But they probably prefer to stay away from becoming the liquidity provider.

[Bamskki]

Developer of Cypher Box here. Thanks for the thread   a few corrections since some of this is outdated or mixed up:

Not developed by Strike. Cypher Box is independent and fully open source (no closed-source modules, swaps included). Strike and CoinOS are optional accounts you can connect via OAuth so they're integrations, not the developer.

0.0.8 is old. Current release is 0.1.1, and it's moved a lot since the version this thread references.

On custody: dkbit98 has it right. The design is intentional: a small Lightning spending balance rides the custodian you choose to connect, and everything past a Withdrawal Threshold you set gets swept to Vaults that are strictly self-custodial on-chain. Keep pocket money fast and cheap, keep savings in your own keys.

internetional's read is correct for today; Vaults are on-chain, not LN channels, and Lightning currently goes through a connected custodian. That's exactly the part that's just got upgraded in v 0.1.1: we rolled out our implementation of Bark SDK, a noncustodial Lightning wallet built on the Ark protocol. Send and receive Lightning payments from keys only you control, no channels to manage, no custodian, and a unilateral on-chain exit available at any time.

Available on app stores
https://github.com/CypherBoxLLC/Cypher-Box
Bam

[nc50lc]

0.0.8 is old. Current release is 0.1.1, and it's moved a lot since the version this thread references.

Thanks for the update.
cygan usually updates his thread as soon as he sees a new release version.
If not him, someone else usually post an update announcement on his behalf.
But somehow, no one bothered updating this thread.

BTW, is there any way for us to verify that you're (one of) its developer?

[satscraper]

But somehow, no one bothered updating this thread.

Took this criticism seriously, ready to prepare myself

Just a few moments ago Cypherbox wallet was updated to 0.1.3 (Android versionCode 28). This release seems to be mainly a maintenance related one (bark library update + reproducibility proof), but the bark update may carry security fixes,though no specific security changes are called out.

[nc50lc]

Took this criticism seriously, ready to prepare myself

Nice, I knew someone will step in.

This release seems to be mainly a maintenance related one

The note in the release page doesn't seem to be the full release notes.
Judging from the comparison between two recent versions, there's more to it than just those mentioned updates.

Ref: github.com/CypherBoxLLC/Cypher-Box/compare/v0.1.1-vc26...v0.1.3-vc28

[satscraper]

Took this criticism seriously, ready to prepare myself

Nice, I knew someone will step in.

Why not step in if Cypherbox developers are on a roll while cygan is too busy to follow them .

Next day brought new v0.1.3-vc29 (Android versionCode 29) release focused mainly on fixing bugs discovered after the previous version. Particularly,  according to fix(ark)-commit the divide-and-reconvert logic was replaced with the straight read:

Judging from the comparison between two recent versions, there's more to it than just those mentioned updates.

Probably yes. To find all the changes  one has to analyze all the commits the given release spans.

[Bamskki]

Took this criticism seriously, ready to prepare myself

Nice, I knew someone will step in.

This release seems to be mainly a maintenance related one

The note in the release page doesn't seem to be the full release notes.
Judging from the comparison between two recent versions, there's more to it than just those mentioned updates.

Ref: github.com/CypherBoxLLC/Cypher-Box/compare/v0.1.1-vc26...v0.1.3-vc28

Good catch, and thanks. The vc29 source change is exactly the fiat invoice fix plus the version bump, nothing else. The mismatch you spotted was on me: I'd attached a placeholder-config CI build to the vc29 release instead of the real one vc28 had, so a binary comparison looked bigger than the notes. I've re-uploaded the matching real-config AAB + checksum and a reproducibility txt file listing every hash and the exact differing entries.

[Bamskki]

0.0.8 is old. Current release is 0.1.1, and it's moved a lot since the version this thread references.

Thanks for the update.
cygan usually updates his thread as soon as he sees a new release version.
If not him, someone else usually post an update announcement on his behalf.
But somehow, no one bothered updating this thread.

BTW, is there any way for us to verify that you're (one of) its developer?

Sure. Every release tag is GPG-signed by our key (info@cypherbox.io, fp 1656230A46FAE9BCE7134C1248C85AD5E8E6F4CD) and shows as Verified on GitHub, and git verify-tag v0.1.3-vc29 confirms it. Give me a nonce (any random string) and I'll post it back clear-signed with that same key, so you can check it against the key that signs the releases.

[nc50lc]

BTW, is there any way for us to verify that you're (one of) its developer?

Sure. Every release tag is GPG-signed by our key (info@cypherbox.io, fp 1656230A46FAE9BCE7134C1248C85AD5E8E6F4CD) and shows as Verified on GitHub, and git verify-tag v0.1.3-vc29 confirms it. Give me a nonce (any random string) and I'll post it back clear-signed with that same key, so you can check it against the key that signs the releases.

I can confirm that it's shown in CypherBoxLLC's GitHub profile here: github.com/CypherBoxLLC
Okay, here's a randomly generated number followed by the current date in MM-DD-YYYY format:

f05740eb0493f30408d5ecef6851413207142026

[Bamskki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Cypher Box maintainer proof-of-key.
Challenge: f05740eb0493f30408d5ecef6851413207142026
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQQWViMKRvrpvOcTTBJIyFrV6Ob0zQUCalYisQAKCRBIyFrV6Ob0
zQI5AQDBkhQtwrIqZnmYy9YBCbpUDz4eSNeNMvCq3r4bJV3QTgEAzZKZGCinQxk0
c5FttHtdsOZljPQurxU7s8bXmonvJgs=
=IivC
-----END PGP SIGNATURE-----

To verify:

curl -s https://github.com/CypherBoxLLC.gpg | gpg --import
gpg --verify proof.txt   #after saving the block above to proof.txt
That reports a good signature from Basem <info@cypherbox.io> over your exact challenge string. It is the same key that signs the release tags, so you can cross-check it against the published binaries.

[nc50lc]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Cypher Box maintainer proof-of-key.
Challenge: f05740eb0493f30408d5ecef6851413207142026
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQQWViMKRvrpvOcTTBJIyFrV6Ob0zQUCalYisQAKCRBIyFrV6Ob0
zQI5AQDBkhQtwrIqZnmYy9YBCbpUDz4eSNeNMvCq3r4bJV3QTgEAzZKZGCinQxk0
c5FttHtdsOZljPQurxU7s8bXmonvJgs=
=IivC
-----END PGP SIGNATURE-----

Message verified:

Code:

gpg --verify clearsigned_message.txt
gpg: Signature made 07/14/26 19:51:13 Malay Peninsula Standard Time
gpg:                using EDDSA key 1656230A46FAE9BCE7134C1248C85AD5E8E6F4CD
gpg: Good signature from "Basem Alasi <info@cypherbox.io>" [full]
gpg:                 aka "Basem Alasi <bamskki@icloud.com>" [unknown]

Note: I only certified the userID that I can verify that's from Cypherbox.

Thanks for confirming, now we can be assured that you're not someone who's impersonating its developer.

[NotATether]

Not developed by Strike. Cypher Box is independent and fully open source (no closed-source modules, swaps included). Strike and CoinOS are optional accounts you can connect via OAuth so they're integrations, not the developer.

CoinOS has an API? Last time I used it, they only had the web login thing. But that was ages ago.

On the Github, for the section that says:

Capsule dashboard with color-coded expiry at a glance:

This is confusing to me. This is an Ark-specific feature, right? If the VTXOs are going to expire and the software has to fire warnings to the users to refresh them, that's kinda bad UX design, right? People can't be expected to use their wallet regularly.

[Bamskki]

Not developed by Strike. Cypher Box is independent and fully open source (no closed-source modules, swaps included). Strike and CoinOS are optional accounts you can connect via OAuth so they're integrations, not the developer.

CoinOS has an API? Last time I used it, they only had the web login thing. But that was ages ago.

On the Github, for the section that says:

Capsule dashboard with color-coded expiry at a glance:

This is confusing to me. This is an Ark-specific feature, right? If the VTXOs are going to expire and the software has to fire warnings to the users to refresh them, that's kinda bad UX design, right? People can't be expected to use their wallet regularly.

Yes Coinos has an API. Cypher Box is confusing to everyone who doesn't try it. No amount of explanation will make sense to you if you don't create a lightning wallet and hot/cold vault. Once you do, you will find detailed instructions about how to use it. It's a shame BTCSessions hasn't done any tutorials for it yet. I made a 6-min intro you can watch it here https://cypherbox.io and I can make more if I get some funding.

The entire project is funded by myself, friends, and family. We haven't charged any fees yet and we're not planning to anytime soon, so if you like it, please consider donating here https://geyser.fund/project/cypherbox?hero=geyserpromotion

There are onchain UTXO capsules with specific shapes and colors that represent their size (tap the question mark icon inside the hot and cold vault to know more), and there are VTXO lightning capsules with 4 colors from green to red so you can tell how urgently they need to be refreshed.

Fully self-custodial wallets such as Bark or the onchain vaults are inherently difficult to use. No amount of fancy automation and UI/UX will make them feel like custodial wallets. We chose to let users manually (but intuitively) control their coins, as opposed to hiding this responsibility behind automated mechanics that cause more harm and confusion than good in the long run. We implemented push notifications that trigger 48h, 24h, 12h, 6h before VTXO expiry, if you click one of them, it's gonna open the app and refresh.

The problem is that refresh cycles take 1-3 hours to finish and what's worse is that sometimes Bark VTXOs get caught in a perpetual loop because the ASP (second.tech) experiences "stuck refresh rounds" which may eventually lead to expiry (irrecoverable loss of funds). This is why, it's highly advised that users come back after 3 hours of initiating a refresh to make sure that it's completed. If it's still looping, you can cancel it, and sweep funds immediately to another lightning wallet like coinos or strike, or take the unilateral exit (1 day before expiry) to hot/cold vault or any external onchain address.

[satscraper]

The latest Cypherbox v0.1.4 (Android versionCode 31) has just seen the light of day covering everything new since v0.1.3, particularly focusing on tightening  Ark and send/swap reliability. Smaller fixes cover the home screen (recovered Ark balance shows up right away, corrected USD symbols, a layout jump fix).