ZKX Wallet | The Secure and Private Wallet 🗽

We’re excited to introduce our new in-wallet swap with DCA orders, powered by Liberty DEX! ⚡️ With faster swaps, DCA orders, and MEV protection, you can scale in and out of PulseChain assets quickly and efficiently - all from your wallet. Available now on the @zkxwallet Web App. Coming to the browser extension in just a few days! 🚀

Can't find the WalletConnect window when connecting ZKX Wallet to PulseX on your phone? It's not you. PulseX tucks it away at the bottom of the screen 👀 First, disconnect any connected dApps and force-close the app for a fresh start. Then: 1. Apps → PulseX → Open 2. Connect Wallet → WalletConnect 3. Find the window at the bottom, tap the QR icon, copy the code 4. Tap Connect dApp at the top, paste, hit Connect 5. Approve ✅ Full walkthrough in the clip 👇

So what does self-custody actually change after something like the Binance hack? Mostly, it changes who the target is. With a non-custodial wallet like ZKX Wallet, there's no shared hot wallet holding everyone's funds. Your keys are encrypted and stay on your device, and we never store or access them. To drain 10,000 ZKX users, an attacker would have to compromise 10,000 separate people, not one laptop at one company. That's the real point. Self-custody isn't magically safe, but it removes the single point of failure. It does move the responsibility to you. The Binance hack also has a lesson that applies directly to personal wallets: EIP-7702. The attacker used a signed authorization to hand control of a Binance wallet to a contract that only they could call, and that contract kept sweeping new deposits for hours. A regular user can be phished for the same kind of signature. What we keep pushing at ZKX: - Read what you sign. A delegation is not "just a signature" - Use a hardware wallet for serious money (Ledger, Trezor, GridPlus, SafePal, Keystone) - Keep your recovery phrase offline. No legit service will ever ask for it - Split your funds into a daily wallet and long-term storage Our direction is simple: give people the tools to hold their own assets safely and privately, and make the risky moments obvious before they hit confirm. Your keys, your coins still holds. It just comes with homework.

$6.36 billion. Ten blockchains. Most of it gone in about 20 minutes. That's the Binance hack from Oct 29, now the largest crypto theft on record. TRM Labs and Chainalysis both point to North Korea's TraderTraitor, the same group behind the Bybit hack. What stuck with me isn't the number. It's the entry point. Based on Binance's own early findings, it started with one engineer's laptop. From there the attacker reached a service container and pushed withdrawals through. TRM thinks the hot wallet signing system itself was made to sign whatever the attacker wanted, across chains with completely different key types. One compromised machine. Millions of users exposed at once. To be fair, Binance says user funds are safe and it will cover the losses, and stablecoin issuers froze around $2.7B quickly. That's a better outcome than most exchange hacks get. But look at what your safety depended on: their balance sheet, their ops team, and how fast Tether reacted. None of that was yours to control. This is the trade-off people rarely say out loud. Custodial convenience means pooling everyone's money behind one set of keys. That pool is the most attractive target in crypto, and state-backed hackers will spend months preparing for exactly that. Exchanges are useful. Just don't treat them as a vault.

Crypto Horror Stories #4: The approval that came back from the dead 🎃 In 2021, they tried a new yield farm. To deposit, they approved the farm's contract to spend their tokens. Unlimited, because that was the default and it saved gas next time. The farm was fun for a few weeks. Then they moved on and forgot it existed. Three years later, the farm's old contract was exploited. The protocol was long abandoned, but the contract was still there, and so was their approval. The attacker didn't need a new signature, a phishing link or a mistake. The permission they had granted years ago was still alive. One evening, the tokens that approval covered left their wallet. The horror: they hadn't touched that farm in three years. The danger was a decision they'd forgotten making. How to stay out of this story: approvals don't expire on their own. Once in a while, check which contracts can still spend your tokens, using a trusted revoke tool you open from its official site, and revoke the ones you no longer use. When you can, approve only the exact amount you need instead of unlimited.

Ever bought the top? Yeah, us too. You put everything in at once, the price dips right after, and now you're just… holding the bag and hoping. That's exactly why we built DCA orders into ZKX Wallet. Instead of one big buy, you split it into smaller ones that run on their own over time. Every minute, every hour, every day, every week, you pick. You also pick how many rounds. Before you confirm, the wallet shows you exactly how much goes into each one, so there are no surprises. How to do it: → Open Swap, tap DCA → Pick your tokens → Set how often + how many times → Hit Review DCA, done It's powered by Liberty DEX, so you also get faster swaps and MEV protection. It's a simple way to scale in and out of PulseChain assets without leaving your wallet or babysitting charts all day. Live now on the ZKX Web App 👇 zkxwallet.com What would you DCA into first?

Passkeys and hardware security keys don't work on fake sites. If your exchange supports them, turn them on today. It's the simplest phishing protection you'll ever add.

Crypto Horror Stories #3: The clone that looked like home 🎃 They'd used the same exchange for years. One night, an email arrived: "Unusual login detected. Secure your account now." The logo, the colors and the footer were all exactly right. The link opened a login page they'd seen a thousand times. They typed their email and password. Then the page asked for their two-factor code. They typed that too. Then it said: "Verification complete. Please wait while we secure your account." The page sat on a loading spinner for two full minutes. They refreshed. It loaded again. They closed it and went to bed, a little uneasy. In those two minutes, someone on the other side had used their password and code on the real exchange, changed their security settings and withdrawn everything. The horror: the clone didn't need to steal anything permanent. It only needed their code for a few minutes. That was enough. How to stay out of this story: never log in through a link in an email or message. Open the app or type the address yourself. Use a passkey or hardware security key where the exchange supports it, because they're tied to the real site and won't work on a fake one. And keep long-term holdings in self-custody, not on an exchange. Tomorrow: the approval that came back from the dead.

Take back you privacy with us.

so what are we actually doing about privacy at ZKX? quick, honest rundown. every ZKX wallet has two modes. Public Mode works like any wallet you're used to. Private Mode, built on Railgun, gives you a private balance with its own 0zk address. what you hold and send there isn't laid out for anyone browsing an explorer. moving funds in is called shielding. you pick the route: Fast takes about 2 minutes, Slow takes about 60 minutes with a lower fee. gas is covered by default, so you don't need to juggle native tokens just to get started. the part we care about a lot: private doesn't mean anything goes. Private Mode uses Private Proof of Innocence (POI), which helps keep known illicit funds out of the private pool. that's why you'll sometimes see a POI sync in the app. it's there for a reason. a couple of honest notes: Private Mode works with recovery-phrase accounts, not imported private keys or hardware wallets. and your first private scan can take up to ~15 minutes. your money, your business 🛡️

ghost addresses haunting your send screen? 👻 ser that's address poisoning, and it's scarier than any Halloween movie. attackers send tiny dust transfers from lookalike addresses so they show up in your transaction history. one lazy copy-paste later and your funds are gone to a ghost. ZKX Address Book 📒 save the addresses you actually send to, give them names you'll recognize, and pick them straight from the Send screen. verify each one carefully once, when you save it, and you never have to go fishing in your history again. pair it with the new update, which shows the names of well-known DEX routers when you confirm a transaction, and that's two fewer places for ghosts to hide 🧠 it lives in Settings → Address Book on the Web App. honest note anon: an address book is only as good as what you put in it. verify the full address, middle included, before you save. trick or treat? we prefer treat 🎃

real talk for a sec. if someone has your wallet address, they can see pretty much everything. your balance. every token you hold. who you paid, when, and how much. your salary if you get paid in crypto. that one late-night swap you'd rather forget. and it doesn't go away. it's not a post you can delete. it's there forever, for anyone who looks. most of us would never hand a stranger our bank statement. but that's basically what happens every time we share an address to get paid, split a bill, or buy something. that's not a "crypto is for criminals" problem. it's a normal-people problem. the person you sold your old laptop to doesn't need to know your net worth. neither does your landlord, your coworker, or that guy from the group chat. privacy isn't about hiding something. it's about not having to show everything. curtains on your windows don't make you suspicious. they make you normal.

Crypto Horror Stories #2: The airdrop that haunts your wallet 🎃 One morning, a new token appeared in their wallet. They hadn't bought it. Its name looked like a reward: "$1,000 USDC Bonus, visit claim-site[.]xyz". Free money, apparently, just sitting there. They tried to swap it. The swap failed. They tried again with higher slippage. It failed again. So they visited the website in the token's name, which said the bonus could be "unlocked" by connecting their wallet and signing one approval. The approval didn't unlock anything. It gave the site permission to spend their real tokens, and over the next hour, their stablecoins disappeared. The haunted token was never meant to be sold. It was bait, sprayed to thousands of wallets for a few cents each, waiting for the one person curious enough to follow the website in its name. The horror: they didn't have to do anything wrong to receive it. Anyone with a public address can get these. How to stay out of this story: tokens you didn't buy are not gifts. Don't visit the website in a token's name, don't try to swap it, and don't approve anything to "unlock" it. Just ignore it, or hide it from your wallet view if your wallet allows, and move on. Tomorrow: the clone that looked exactly like home.

If a private key or recovery phrase has ever been exposed, even for a minute, that wallet is compromised forever. Move what you can to a new wallet. Never use the old one again.