Cove: mobile wallet setup

Cove is an open-source, Bitcoin-only wallet for iOS and Android. It will happily hold a small amount of bitcoin itself, and it will also act as the coordinator for a hardware signer — building transactions, passing them to a COLDCARD or a TAPSIGNER over QR or NFC, and broadcasting what comes back.

That second job is the interesting one. Most people assume driving a hardware wallet means sitting at a desktop with Sparrow or Electrum. Cove puts that whole workflow on a phone, which for a lot of people is the difference between using their hardware wallet and leaving it in a drawer.

It also means being honest about which screen you are trusting, and that depends entirely on which signer you pair with. This page sets up both modes and then makes that distinction explicit.

A phone running Cove displaying a QR code, propped beside a hardware signer that is scanning it, on a plain desk with no computer in sight.

Image to come

1Three ways to use it

Decide which of these you are doing before you start, because the security properties are completely different.

• A hot wallet. Cove generates and holds the keys on your phone. Convenient, genuinely useful, and appropriate for spending money rather than savings.
• A watch-only wallet. Import an xpub or a descriptor and Cove shows balances and builds transactions, but holds no keys and can sign nothing.
• A coordinator for a hardware signer. The keys stay on the hardware; Cove does everything else. This is the setup worth aiming for if you hold a meaningful amount.

The first and third are not rivals. A spending wallet and a savings wallet is the shape most people should end up with, and Cove can be either.

2Creating a hot wallet

If you want a phone wallet for everyday amounts, this takes two minutes.

• Install Cove from the App Store or Google Play and choose to create a new wallet.
• Write the recovery words down on paper or metal, in order, before going any further. These are ordinary BIP39 words and they restore into any wallet, so this backup is genuinely portable.
• Set the app lock — a PIN or biometrics. This protects the app on an unlocked phone; it is not what protects the coins.
• Decide about cloud backup. Cove offers an end-to-end encrypted cloud backup protected by passkeys. It is a real convenience and it is not a substitute for the written words.

• A hot wallet's keys live on a phone that browses the internet, installs apps, and gets left on tables. Keep the balance to what you would carry in a physical wallet.
• The encrypted cloud backup depends on your cloud account and your passkeys. Words on metal depend on nothing.

3Pairing a hardware signer

This is where Cove earns its place. Import the signer's public keys and Cove becomes the coordinator while the private keys never leave the device.

• Choose to import a hardware wallet and pick the transfer method your device supports.
• By QR — hold the phone up to the device's screen. Cove reads both BBQr and UR, the two formats used to split large payloads across animated codes.
• By NFC — tap the device or card against the phone.
• By file — import the export your device wrote to a microSD card.
• Confirm the fingerprint matches what the device shows. This is the check that proves Cove is watching the wallet your device will actually sign for.

4Signing from a phone

The round trip is the standard air-gapped PSBT workflow, with the phone playing the part the desktop usually plays.

• Build the payment in Cove. It selects coins, sets a fee, and produces a PSBT.
• Pass it to the signer — show a QR code for the device's camera, tap over NFC, or write a file.
• Verify on the signer, then approve. More on this in the next section.
• Bring the signature back the same way.
• Cove finalises the transaction and broadcasts it.

5Which screen are you trusting?

This is the part that decides how much this setup is really worth, and it depends on the signer rather than on Cove.

The point of a hardware wallet with a display is that a compromised coordinator cannot lie to you about a payment: the device shows the amount and destination from the data it is signing, on hardware the attacker does not control.

• With a COLDCARD, Krux, SeedSigner, Jade, or Passport, that protection is intact. Read the amount, the address, and the fee on the device's own screen. The phone is just the thing that built the transaction.
• With a TAPSIGNER, there is no screen. The card signs what it is handed and cannot tell you what that is, so the phone display is the only thing you have. That is a reasonable trade for an everyday key and a poor one for savings — the TAPSIGNER guide goes into it properly.

A hardware signer with a screen protects you from your coordinator. A signer without one asks you to trust it.

6The app-lock features, and their cost

Cove offers more than a PIN: there are trick PINs that wipe the app's data or open a decoy wallet, in the same spirit as the ones on a COLDCARD.

They carry the same trade, and it is worth stating in the same terms. Each one is a defence against somebody holding your phone, purchased with a new way to destroy your own access.

• A wipe is only survivable because of your written words. If the recovery words are not on paper or metal and tested, a wipe is a permanent loss rather than a clever defence.
• A decoy wallet you never funded is not convincing, and one you did fund is money you may hand over.
• Write down what you enabled, and keep that note with your backup. A trick PIN you have forgotten configuring is a trap you set for yourself.

7Point it at your own server

By default a wallet app asks somebody else's server for your balance, which means telling that server every address you own. Cove lets you connect to your own Electrum or Esplora node instead.

If you already run a node, this is a five-minute settings change that closes a real privacy leak. If you do not, it is the strongest argument for eventually running one — and nothing else in this guide depends on it.

8Before you fund it

• Confirm the recovery words are written down and stored offline, for a hot wallet.
• For a hardware setup, confirm the fingerprint in Cove matches the one on the device.
• Generate a receive address and verify it on the hardware device's screen before sending anything to it.
• Send a small test amount, confirm it arrives, then sign a transaction sending it back out.
• Only then move a balance you would mind losing.

The short version

Cove is a Bitcoin-only, open-source phone wallet that works as a hot wallet for spending money or as a coordinator for a hardware signer over QR, NFC, or file. Everything about how much that protects you comes down to whether the signer has a screen you can read the transaction on.