Your wallet is protected by your Telegram account and your PIN. This page lists each protection and what it does not cover. See also Custody and keys.
PIN
- 6 digits. A PIN that is one digit repeated, such as 111111, or a straight run, such as 123456 or 654321, is refused.
- Required to withdraw, to bridge out and to export keys.
- 5 wrong tries in a row lock the PIN for an hour. The lock stops withdrawing, bridging out and exporting keys. Each lock in a row doubles the last one, up to 24 hours, and a right PIN starts over.
- You are told in the bot when a PIN is set, changed, locked, reset or frozen, and when a reset is cancelled.
- A PIN can only be set or reset in the bot, using the on-screen keypad so the digits never sit in the chat.
PIN reset, hold and freeze
- A reset takes 24 hours and a right PIN cancels it.
- When you set a new PIN after a reset, withdrawing, bridging out, exporting keys and adding a NEAR key wait a hold, 2 hours by default. Buying and selling are not held. You get a reminder every 30 minutes and a message when the hold ends.
- The "Not me, freeze my wallet" button clears the PIN, blocks setting a new one for 24 hours and ends every web login. Nothing can be withdrawn or exported during the freeze. Your funds stay where they are, and buying and selling still work.
- The button appears on send alerts, new address alerts, limit change alerts and hold reminders.
Saved addresses
You can limit sends to saved addresses. It is off until you turn it on, in the Withdrawal PIN menu in the bot or in Security on the web. Once it is on, any address you had already sent to is saved and works at once. A new address is saved the first time you try it and works one hour later, and the bot tells you when one is added. This also holds bridge sends to an address that is not yours. Turning the limit off also waits an hour, and tells you, so someone who takes over your Telegram cannot switch it off and send at once. You can remove a saved address on the web, in Security. An address you remove starts its hour again if you add it back.
Send alerts
Every send out of your wallet is announced in the bot with the amount, the full address and a Not me, freeze my wallet button, with a link to the transaction when the chain gives one. A bridge to an address that is not yours is announced when it starts. A new web login is announced too, with a Log out everywhere button.
Trusted contact
You can name up to two people you trust to get a copy of your security alerts. In the bot, open Wallet, then Withdrawal PIN, then Trusted contact, and send the link to your contact. When they open it, they are told what it means. From then on they get a copy of every alert: sends out, new addresses, PIN and limit changes, and freezes. They see amounts and addresses, and they cannot act on your account. If your Telegram is taken over, the person holding it cannot hide the alerts, because your contact also gets them. Removing a contact waits an hour and tells you, and your contact can stop at any time.
Your own limits
On the web, in Security, or in the bot with /limits, you can set spending limits lower than Rex's. A lower limit applies at once. A higher limit, or clearing one, waits an hour and sends you an alert with a freeze button. See Limits.
Lock trading
Lock trading holds new buys, snipes and automatic buys on your account while you are away. Lock it from the Withdrawal PIN menu in the bot or from Security on the web. Unlocking asks for your PIN, and only works in the bot. Selling and withdrawing are never held, so you can always get out.
If Rex pauses buying
If something goes wrong with a route or a venue, the team can pause new buys for everyone while the bot keeps running. Selling and withdrawing keep working, and the screen says so.
Web sessions
- You log in from a link the bot sends. It works once and lasts 3 minutes.
- A session lasts 14 days, or 3 days without use. Tokens are stored hashed.
- The Security page lists your web logins. You can log out of this browser or log out everywhere. The bot lists them too and can log out everywhere.
- Withdrawing from the web also needs a Confirm tap in the bot. Exporting needs the same tap, or the page opened inside Telegram. These requests expire after 3 minutes.
Key export
Needs your PIN and your confirmation in Telegram, is limited to 3 in any 24 hours, and is logged. The key is encrypted to a key your browser makes, and shown once. It is never shown in the chat.
What these do not cover
- Someone who controls your Telegram session can trade, up to your limits.
- Someone who also learns your PIN can withdraw, up to your daily withdrawal limit. If you turned on saved addresses, a new address also waits an hour.
- A trade at a bad price inside your slippage is still your trade.
- The alerts arrive in your Telegram account. If that account is taken over, the person holding it can see and delete them, unless you named a trusted contact, who gets a copy.
Read Risks for the rest.
Reporting a problem
If you find a security problem, tell the team on X or with /support in the bot. Do not post it publicly first. The contact is also in security.txt.