Terms & Conditions

Acceptance and permitted use

By accessing or using this website, you agree to these Terms & Conditions and to the Privacy and Cookie & Local Storage policies. If you do not agree, discontinue use of the website.

You may use the published material for personal research, technical comparison, account-safety preparation and due diligence. You must not present the report as proof that an unauthenticated binary, domain, token, dApp or support contact is genuine or currently maintained.

• Do not use the website to request or exchange private keys
• Do not misrepresent historical evidence as a current security certification
• Do not use the interface to facilitate fraud, credential theft or deceptive signing

Nature and scope of the service

This is a HIVE Wallet product website with desktop package downloads and technical guidance derived from the HiveWallet.net Advanced Technical and Operational Report dated 1 September 2026. It explains native asset support, account authorities, local signing, storage controls, privacy boundaries, recovery and operational risk.

The website itself is not a Hive node, custodian, bank, exchange, broker, token issuer, password-reset provider, transaction-reversal service or source of investment, financial, tax or legal advice. It does not hold funds, receive private keys or provide account recovery.

Evidence standard and methodology

The report triangulated official product statements, public source code, changelog history, distribution records, Hive protocol documentation, Hive Engine documentation and ecosystem wallet listings. Code observations refer to the repository reviewed on the analysis date and may not match every historical or private build.

Four labels govern interpretation: direct support, bridge support, protocol capability and not established. ‘Not established’ means that reviewed public evidence was insufficient; it does not assert impossibility in every past or private version.

• Direct support: first-class behavior established in reviewed evidence
• Bridge support: an embedded dApp can request the operation
• Protocol capability: Hive supports it without proof of a complete wallet flow
• Not established: evidence is insufficient for the claimed capability

Methodology limitations

The report did not have a private audit, unpublished source, developer interview, production signing certificate, live-device installation, packet capture, reverse engineering of store binaries or penetration test. Cryptographic comments are implementation-assurance observations, not claims of successful exploitation.

Secondary app-market information is used only for distribution history and is labeled accordingly. No statement on this website should be converted into a guarantee about every binary, dependency, operating system, RPC endpoint or future release.

Product identity and independence

The report concerns the iOS and Android application published by RoelandP and represented historically by hivewallet.net and github.com/roelandp/hivewallet. Legacy Steem names in identifiers, source comments and dependencies reflect the project's migration history.

The name is not unique. Users must not confuse it with another Hive-branded wallet, Hive Keychain, an exchange account, the discontinued Bitcoin/Litecoin product with a similar name or an unrelated browser extension. Product identity should be verified using domain, repository owner, package or store identifier, developer identity and signing certificate—not an icon or name alone.

Asset and network boundaries

The exact direct cryptocurrency scope established by the report is HIVE and HBD. Hive Power or VESTS, Resource Credits, savings, pending rewards, conversions and delegations are account states or protocol operations, not additional direct currencies.

Hive Engine token transfer can be requested through a historical custom-JSON dApp bridge, but complete native token discovery, authenticity validation, prices, history, markets and NFT support were not established. No reviewed evidence establishes support for Bitcoin, Ethereum, Solana, Cardano, Polkadot or another non-Hive blockchain.

• HBD is not bank USD, USDC or USDT
• A wrapped ticker on Hive Engine is not automatically the native asset it names
• A Hive account name is not an EVM, Bitcoin, Solana or exchange-deposit address

Self-custody and credential responsibility

Hive uses named accounts with owner, active, posting and memo roles rather than a conventional BIP39 seed-centric model. You are responsible for safeguarding valid authorities, local wallet passphrases, devices, independent backups and the recovery account configuration.

The blockchain does not provide a conventional email password reset. Losing all valid owner or master credentials can be permanent. A local HiveWallet passphrase protects the historical wallet file but is not itself authoritative blockchain recovery material.

Least privilege and complex authorities

Use posting authority for eligible social actions, active authority for transfers and applicable financial operations, and keep owner authority offline for recovery and critical authority changes. Importing a master password into any wallet should be treated as owner-level exposure because it may derive every role.

Hive authorities can include weighted keys and delegated accounts. The report did not establish complete multisignature coordination, partial-signature export, hardware-wallet support or an air-gapped signing workflow in HiveWallet.net. A complex account may be readable while remaining inoperable through that client.

• Compare on-chain authority thresholds with actual signer capability
• Do not import owner authority for routine use
• Rotate affected roles with protected owner authority after suspected exposure

Transactions, memos and irreversible actions

Before signing, verify the selected account, recipient, amount, HIVE or HBD symbol, memo, exact operation, requested authority, recent block context and expiration. Record the transaction identifier and confirm material-value activity using a second trusted explorer or RPC endpoint.

Confirmed transfers and authority changes may be irreversible. Resource Credits replace the usual visible monetary network fee for many Hive operations, but depleted RC, stale RPC data, malformed transactions, insufficient authority and wrong destinations can still cause failure or loss.

QR codes, links and signing requests

QR codes and hive://, hivewallet:// or hivewallet.net links are input channels, not authenticity seals. They can prefill accounts, keys, transfers or signing routes and may be manipulated.

The final confirmation screen is the authoritative review point. Cancel any request whose effective operation, authority, account, amount, asset or memo differs from your intent, regardless of the website's description or familiar branding.

• Verify every prefilled field
• Avoid importing key QR codes into unverified software
• Treat shortened or redirected links as additional risk

RPC nodes and network dependency

HiveWallet.net is a light client, not a full node. The reviewed source used https://api.hive.blog as a default endpoint and allowed node changes in later versions. RPC nodes provide account state, history, chain properties and broadcast access.

An RPC can observe request metadata and return stale or incomplete information, though it should never receive a private key. A custom node changes rather than eliminates trust by making the user responsible for synchronization, TLS, firewall, availability and maintenance.

Embedded dApps and Hive Engine

The historical embedded browser exposed a subset of Keychain-compatible requests. A website could supply intent and parameters while the wallet mapped the request, selected a role key, presented confirmation, signed and returned a result.

Compatibility is not endorsement. Legitimate domains can be compromised, malicious sites can imitate known applications, and technically valid custom JSON can still be economically harmful. Persistent approvals increase exposure and should be minimized and reviewed.

• Inspect the effective operation rather than the dApp label
• Clear permissions no longer required
• Do not treat bridge access as complete native wallet support

Security controls and assurance gaps

Positive reviewed controls include watch-only mode, role separation, on-device signing, AES-based encrypted local storage, a strong-passphrase check, per-install device material, optional native keychain use and biometric retrieval.

The report did not establish a modern memory-hard password KDF, random per-encryption salt, an authenticated-encryption guarantee, independent security audit, signed reproducible build or current source-to-binary mapping. A strong passphrase cannot compensate for malicious code, a compromised device, keylogging or an untrusted binary.

Maintenance and distribution warning

The last known Android retail version identified by the report was 2.4.0.2 from December 2021. A secondary market record reported Google Play removal on 3 May 2024. A historical Apple application identity was found, but an active current listing was not independently established.

The reviewed repository showed 125 commits, nine open issues, no visible release packages or tagged binary releases, and no public activity newer than 2022 established during review. HiveWallet.net was absent from Hive's current wallet directory. These are maintenance warnings, not cryptographic proof of compromise.

• A live domain is not release authentication
• A checksum proves file consistency, not publisher identity or safety
• Do not sideload an unauthenticated copy for material-value use

Deployment package distribution

This website serves deployment-provided Hive wallet packages for Windows x64, macOS Apple Silicon and Linux AMD64. Their presence on this domain and their published SHA-256 digests establish availability and file consistency only. The technical report did not independently authenticate version 4.2.1.1, its publisher signature, source tag, dependency set or source-to-binary provenance.

Before using any wallet, independently verify publisher identity, package identifier, platform signature, source tag, checksum, dependency and build provenance, operating-system compatibility, supported operations and a complete recovery and key-rotation plan. Do not bypass operating-system warnings merely because a file was linked here.

Recovery, migration and incident response

Existing users should migrate before an old application or device fails. The Hive account persists across compatible interfaces, so migration often means establishing trusted access to the same account rather than transferring every asset to a new address.

Inventory liquid HIVE/HBD, savings, rewards, vesting, delegations, conversions, orders, authorities, recovery account, custom operations and important Hive Engine balances. Test watch-only access, import the minimum role, make a small transfer, rotate compromised authorities and retire the old environment only after independent verification.

• Keep owner or master recovery material offline
• Inspect the designated recovery account and authority history
• Treat unexpected authority or delegation changes as an incident

Public source and license description

The historical repository is publicly readable and supports architecture review and community forking. The report records a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 license.

Because that license restricts commercial use and Creative Commons advises against using CC licenses for software, the report describes the project more precisely as source-published or source-available rather than conventional OSI-approved open-source software. Public code alone does not authenticate a compiled binary.

Third-party services and external links

Hive RPC operators, embedded dApps, Hive Engine services, GitHub, application stores, block explorers and sites linked from the report are independent. Their content, availability, security, terms and privacy practices are outside this website's control.

A link documents evidence or offers a verification starting point; it is not an endorsement. You are responsible for inspecting the final destination, TLS connection, publisher, requested permissions and effective operation.

• Never rely on a logo alone
• Do not assume a linked page remains unchanged
• Do not grant an external service more authority than its task requires

Suitability and user decision

The report considers the product useful as a historical source and potentially for cautious recovery of an existing installation. Suitability is low for a new wallet user, poor for comprehensive Hive Engine portfolio use and unsuitable for a high-value treasury without current release, audit and custody assurance.

Watch-only monitoring reduces private-key exposure but does not eliminate outdated-software or RPC privacy risks. Simple HIVE/HBD use was historically aligned with product scope, yet current use remains conditional on authenticated distribution and maintenance evidence.

No warranties

The website, product information, desktop packages and linked technical material are provided on an as-is and as-available basis to the fullest extent permitted by applicable law. No warranty is made that content is complete, current, error-free, suitable for a particular purpose or compatible with a specific device, account authority or service.

Blockchain state, software repositories, store listings, RPC endpoints and external policies can change after the analysis date. A future verified release or audit could improve the assessment, while new vulnerabilities or service changes could worsen it.

Limitation of responsibility

To the fullest extent permitted by applicable law, the website operator is not responsible for loss arising from compromised credentials, incorrect recipients, public memos, malicious or outdated binaries, device failure, malware, dApp requests, RPC behavior, token issuer risk, network conditions, user error or irreversible signed actions.

Nothing in these terms excludes responsibility that cannot legally be excluded. Because the project does not identify a verified production legal entity or governing jurisdiction, this text does not invent one; the deployment operator must complete any mandatory legal disclosures.

Changes, severability and contact limitation

These terms may be revised when the report evidence, website functionality, distribution status or applicable requirements change. The revision date identifies this version. If one provision is unenforceable, the remaining provisions continue to the extent allowed by applicable law.

The current project contains no verified legal or support contact endpoint. The demo assistant does not transmit messages. A production operator must provide accurate contact details before representing that support, privacy requests or legal notices can be received through the website.