Contacts and Link Up

Simple

Contacts are the people you pay. Once someone is saved, you can pay them without ever typing their long address. Find them on the Contacts tab.

The easiest way to add someone is Link Up: on Contacts, both tap Link Up while standing near each other, then tap each other's name. Your phones swap details over Bluetooth, locked so nobody nearby can read them.

Both phones then show a six-digit code. Check the codes match before you save. If they do, the addresses came straight from your friend's phone, and the contact is marked “Verified in person”.

Far apart? Use Share my contact to send a locked contact card by email or message, and tell your friend the password a different way, such as a phone call.

You choose which coins' addresses to share. Contacts never get your recovery phrase, your balances or any way to spend your money.

Detailed

Bluetooth Low Energy

Link Up uses Bluetooth Low Energy, the short-range radio standard built into every modern phone. Phones nearby can announce themselves and connect directly, with no internet, no server and no account in between.

Encryption without a shared password

The two phones agree on a secret key over the air using public-key key agreement, a standard technique: someone listening to the radio sees everything that's sent, yet still can't work out the key. Each phone's details are then encrypted with that key.

Why the code matters

Key agreement alone can't tell you who is on the other end. An attacker sitting in the middle could agree one key with you and another with your friend. The six-digit code is drawn from the agreed key, so if anyone is in the middle, the codes on the two phones differ. Comparing them face to face closes that gap.

Signed contact cards

A contact card is locked with a password you choose and signed with a key that belongs to your wallet. Your friend's phone can check the signature, so a card that was changed on the way is caught, and a later card from you updates your contact instead of creating a stranger.

Private and public addresses

• On Bitcoin-style coins and Monero, each person you share with can get an address of their own, so two contacts comparing notes can't link your payments.
• On account-based networks such as Ethereum, XRP or Solana, an address is public: anyone who has it can look up its full history and balance. Share those only when you need to.

In depth

The key-exchange problem

Two strangers want a shared secret, but every message between them can be overheard. Diffie–Hellman key agreement solves this: each side picks a secret number, publishes a value derived from it, and combines its own secret with the other's public value. Both arrive at the same result; an eavesdropper, holding only the public values, cannot.

shared = a × (b × G) = b × (a × G)

Modern systems do this on an elliptic curve, where a × G is easy to compute but recovering a from it is infeasible.

Man-in-the-middle attacks

Diffie–Hellman proves you share a key with someone, not with whom. An active attacker can run two separate exchanges, relaying and reading everything. The defence is authentication: confirming, over a channel the attacker can't fake, that both sides hold the same key.

Short authentication strings

One elegant form of authentication is a short code derived from the shared key, read by two people standing side by side. A middle attacker holds two different keys, so the two codes match only by chance: about one in a million for six digits. The human eye becomes the trusted channel.

Authenticated encryption

Once a key is agreed, data is sealed with an authenticated cipher, which both hides the content and attaches a tag computed from it. Any change in transit makes the tag check fail, and the message is rejected rather than misread.

Password-based encryption and signatures

A password is too weak to be a key directly, so it is first run through a deliberately slow, memory-hungry stretching function that makes every guess expensive. A digital signature then proves who made the content: only the holder of the private key can produce it, and anyone with the public key can check it.