Is Blockstream Jade (Blockstream app) safe? What its own terms say
Is Blockstream app safe to use for casino deposits?
Blockstream app's terms disclaim custody but do not settle who holds key material. Its terms name no gambling rule (blockstream.com, read 2026-10-07), which is an absence, not a permission. Contracting party: Blockstream Corporation, place of incorporation not stated. 5 points are not verified. 1 primary-source incident is recorded. Liability: excluded for all loss. Chains named: Bitcoin.
Documents last checked Reviewed by CryptoGuardz Register Desk, editorial desk
Disclosure: CryptoGuardz has no commercial relationship with Blockstream Jade (Blockstream app), earns nothing if you install it, and has not contacted the company or given it notice of this entry. Every statement below is either a verbatim quote from a document Blockstream Jade (Blockstream app) publishes or a statement about a public record, and both carry the date they were read. Corrections go to the corrections page.
1. What this means for you
Consequences first, in the conditional, each one produced by a clause in a document Blockstream Jade (Blockstream app) publishes itself. Every line links to that clause, quoted in full and dated. None of them is a claim that Blockstream Jade (Blockstream app) can move your coins on chain: the terms disclaim that power and this register takes them at their word on it.
- You are contracting with someone you cannot name if you use the swap, the on-ramp or the staking inside the app 2 sub-service clauses are recorded across 1 kinds of service, and most of the counterparties are identified in the terms only as a third party.
- You are relying on a document that does not describe the product if you read only the terms The recovery model the marketing pages describe is not the recovery model the binding document describes.
2. What this entry records, and what it does not
This register publishes no number for a wallet. The payout score on the casino register has five defined components and a published arithmetic; no equivalent instrument exists here. What follows is a field-by-field account of what was read, where and when.
| Binding terms | Read in full4 clauses captured verbatim across 4 topics, retrieved 2026-10-07 |
|---|---|
| Contracting entity | Blockstream CorporationNo jurisdiction of incorporation stated in the binding document |
| Custody position in the terms | Does not settle who holds key materialCannot be answered with a single value. For a singlesig account, the keys are on Jade and Blockstream holds none. For a 2-of-2 multisig account in the Blockstream app, Blockstream's help centre states the second key is held on Blockstream Green servers behind two-factor authentication, so Blockstream holds one of two signing keys and cannot spend alone. Separately, Jade's PIN protection depends by default on a blind oracle managed by Blockstream that holds part of the AES256 key encrypting the wallet on the device; Blockstream states the oracle learns neither the keys nor the PIN. |
| Sub-services | 2 clauses recordedNode and RPC. A count of recorded clauses, not of distinct companies. |
| Code audit | Not measuredNo security audit, source review or reproducible-build check has been carried out or read by this register. A wallet's safety is largely decided there, and nothing on this page speaks to it. |
| First-party test | Not measuredNo transaction has been signed, no swap executed and no recovery flow run through this product by this register. |
| Default node provider | Not disclosedNo RPC or node provider is named in any primary document retrieved. |
3. What we could not verify
Every entry carries this section. The gaps are published because a reader deserves the limits of the check as well as its results.
- Whether any terms of service govern the Blockstream app or Jade specifically. The only terms linked are the 2018 website and store terms, which do not mention either product.
- Blockstream Corporation's state of incorporation and registered address.
- Whether Blockstream can refuse to co-sign a multisig transaction, and the timelock recovery path if its server is unavailable. The help article retrieved does not say; the linked article on how multisig works was not read.
- What Blockstream's default Electrum or Esplora servers see when the app syncs. Not described in the privacy policy.
- Buy, swap or Lightning service providers inside the app, if any. None is named in any document retrieved.
4. Who you are contracting with
The binding document names a company. It does not name a jurisdiction of incorporation, which is a different and smaller gap: a reader can find the counterparty but not the register it sits in.
| Named counterparty | Blockstream Corporationsource · retrieved 2026-10-07 |
|---|---|
| Jurisdiction | Not stated as incorporation. The terms select California law and the state or federal courts in California. The privacy policy names the controller as Blockstream Corporation Inc. No state of incorporation or registered address appears in either document. |
| Relationships disclosed | None by name. The terms refer generically to Third-Party Websites and Third-Party Applications; the privacy policy refers to unnamed third-party service providers. Blockstream itself operates the default Jade blind oracle and, for multisig accounts in the Blockstream app, the second signing key. |
This website and any other websites of Blockstream Corporation ("Blockstream"), its affiliates or agents (collectively, the "Website") and the information on it are controlled by Blockstream.blockstream.com
THE AGREEMENT AND ANY ACTION RELATED THERETO WILL BE GOVERNED AND INTERPRETED BY AND UNDER THE LAWS OF THE STATE OF CALIFORNIA, WITHOUT GIVING EFFECT TO ANY PRINCIPLES THAT PROVIDE FOR THE APPLICATION OF THE LAW OF ANOTHER JURISDICTION.blockstream.com
5. The custody claim, and what the binding document says
What Blockstream Jade (Blockstream app) says in the place a user reads, against what it says in the place that binds a user.
Keep your bitcoin safe with Blockstream Jade. Our secure, open-source hardware wallet is built for self-custody.blockstream.com · 2026-10-07
The Website provides Users with content and information about our Services and allows Users to subscribe to our mailing list. The Website also allows Users to purchase products through our online store ("Blockstream Store").blockstream.com · 2026-10-07
Your bitcoin is stored on the blockchain, and can only be spent using the encrypted keys stored on Jade.blockstream.com
Hardware wallet. The device holds the keys. The companion app is the Blockstream app (formerly Blockstream Green). The only terms linked from the app and Jade pages are the Blockstream Terms of Use effective 16 January 2018, which define the service as the website and online store and do not mention the app, Jade, private keys or custody. The binding document therefore says nothing about custody; the quote above is its definition of what it covers.
6. Recovery, and where the terms and the marketing differ
| Cloud or hosted backup offered | no |
|---|---|
| What is stored | Nothing by Blockstream that can restore the wallet. The user keeps the 12 or 24 word recovery phrase. The default blind oracle holds part of the key that encrypts the wallet on the Jade device, not a backup of the phrase. |
| Where | On the Jade device, encrypted, and in the user's own record of the recovery phrase. |
| Changes the custody position | no |
Since the oracle only has a part of the AES256 key, it is blinded to any of your wallet's keys and PIN.help.blockstream.com
The terms say nothing about keys, recovery, the blind oracle or multisig co-signing; the help centre describes all three. The difference is that the binding document does not describe the product: a user relying on Blockstream's oracle to unlock Jade, or on Blockstream's server to co-sign a multisig spend, has no clause governing either service.
7. The app is not the wallet
2 clauses, each one a place where the product routes a user to a counterparty the user never contracts with by name, under terms the user never opens. The count is of recorded clauses and not of distinct companies: two entries can name the same counterparty and each still be a separate thing the terms permit.
Since the oracle only has a part of the AES256 key, it is blinded to any of your wallet's keys and PIN.help.blockstream.com
The first key is on your device protected by a PIN code and is backed up with a 12-word (or 24) recovery phrase. The second key is held on the Blockstream Green servers protected by two-factor authentication (2FA).help.blockstream.com
8. Withdrawing your access to the interface
Your keys are yours. The software you reach them through is licensed, and the licence can be withdrawn. 0 clauses are recorded on this point.
9. Who can block an address
Blockstream Jade (Blockstream app) claims no power to block an address in the documents read. No clause in the documents read discloses that another party in the stack can freeze or blacklist an address either. That is an absence of disclosure, not a guarantee that no such party exists.
10. What the terms say about gambling
Position recorded: not disclosed. No clause naming gambling, betting, casinos or wagering was found in the documents read. That is an absence in the documents, not a permission, and the general prohibition on unlawful use still applies.
The card side of the same question is on the card register, and the casino side on KYC on withdrawal.
11. Chains it names
Of the eight chains this register filters on, Blockstream Jade (Blockstream app) names 1: Bitcoin. Not named on the pages read: Ethereum, Solana, TON, Tron, BNB Chain, Base, Polygon. The Blockstream app and Jade support Bitcoin, the Lightning Network and the Liquid sidechain. Lightning and Liquid are not in the register's chain filter and are not listed. No other network is supported.
On‑chain Bitcoin, Lightning, and Liquid assets, all at your fingertips in one unified view.blockstream.com
12. Liability, amendment, arbitration and where you can use it
The liability clause excludes liability for all loss rather than capping it at a figure. It is the clause that decides what the rest of the document is worth.
IN NO EVENT SHALL BLOCKSTREAM PARTIES BE LIABLE FOR ANY LOSS OF PROFITS, REVENUE OR DATA, INDIRECT, INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF OR IN CONNECTION WITH BLOCKSTREAM PROPERTIES, THE BLOCKSTREAM STORE OR THE LIGHTNING NETWORKblockstream.com
Opening of a longer exclusion. No monetary cap was found.
PLEASE NOTE THAT THE AGREEMENT IS SUBJECT TO CHANGE BY BLOCKSTREAM IN ITS SOLE DISCRETION AT ANY TIME.blockstream.com
You represent and warrant that (i) you are not located in a country that is subject to a U.S. Government embargo, or that has been designated by the U.S. Government as a "terrorist supporting" country and (ii) you are not listed on any U.S. Government list of prohibited or restricted parties.blockstream.com
What the provider states it processes, and who it passes it to. Recorded because a wallet that never touches a key can still see every address you hold.
This is an opt-in program. If you select Don't collect data or turn off the Data collection setting in App Settings, the app won't collect or share any analytics datahelp.blockstream.com
Help-centre statement. The help centre lists send and receive addresses and account balances as not collected. The privacy policy, dated 16 January 2018, does not describe the app at all.
13. Public record
Matters of public record, taken from primary sources and stated with them. Both of the records below were disclosed by the provider itself or entered in a public vulnerability register, rather than found in the press.
Blockstream disclosed a vulnerability in Jade firmware 1.0.24 to 1.0.36: a missing size check on descriptor parameter data allowed malware on a connected host, with the device unlocked over USB or Bluetooth, to overwrite the stack and cause a crash or limited code execution. Fixed in 1.0.37, released 13 November, with anti-rollback protection added in 1.0.38. Blockstream reported no confirmed loss of user funds.
No confirmed loss of user funds related to this issue.
14. Who should avoid Blockstream Jade (Blockstream app)
Anyone who needs a named party to be answerable for a loss. The liability position is excludes liability for all loss, and the terms disclaim responsibility for every third-party service the app routes you into.
Related entries
Or read the whole wallet register, the card register, the same method applied to exchanges and to crypto casinos, the clause library at clause watch, or how this register works.
15. Sources
- Blockstream Terms of Use, effective 16 January 2018
- Blockstream Privacy Policy, 16 January 2018
- Blockstream app page
- Blockstream Jade product page
- Blockstream help centre, How does Jade protect my recovery phrase with a blind oracle
- Blockstream help centre, What does Blockstream Green's multisig protect from
- Blockstream help centre, pseudonymous data collection
- Blockstream blog, Jade Security Disclosure, 16 December 2025