What Gridinsoft observed on Prunebit.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260825041930-82c6dce1
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Suspicious Website
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The current independent first-party review classifies prunebit.com as a Suspicious Website with high confidence. PruneBit corrected its prior reserve and audit representations, but the critical wallet-secret issues remain: current client code still sends complete seed phrases, private keys, and PINs to server endpoints, while current pages say that the wallet is local and non-custodial and that those secrets are never readable by the operator. Public administrator code still implements a workflow to return and display a selected wallet's mnemonic. No specific malware payload, malicious APK execution, confirmed victim, confirmed theft, or transaction was established. Therefore the evidence supports a suspicious classification, not a claim that a cryptocurrency scam or distinct malware sample was proven.
Analyst findings
Review 6 documented observations View evidence
The apex and www hosts returned the same current page. PruneBit still describes itself as a non-custodial wallet running entirely in the browser, says that wallet data stays local and that keys stay on the user's machine, and states that seed phrases and PINs are never readable by the operator or anyone else.
-
HTTP status
200 - Public artifact URL https://prunebit.com/
- Public artifact URL https://www.prunebit.com/
- Public artifact URL https://prunebit.com/privacy.html
- Page element PruneBit is a secure multi-coin wallet Non-Custodial that runs entirely on your browser.
- Page element Your keys stay on your machine.
- Page element Your seed phrase and PIN never leave your device unprotected — they are encrypted with AES-256-GCM and are never readable by us or anyone else.
- File SHA-256 ea2d049725118b105f7b6715f841aa73f60e0e55eb6e432bc4c51d3a69dc4fe1
- File SHA-256 c167e8ca0fc924a8b82e7ffec34f9c2144dd90dc5f38e2d01b73c66702fd0d11
The current import client still constructs a request containing the complete mnemonic and PIN for POST /api/import. Its private-key flow still constructs a request containing the complete private key and PIN for POST /api/import_private_key. The reviewed client code does not apply a separate client-side encryption envelope to those values before constructing the requests.
-
HTTP status
200 - Public artifact URL https://prunebit.com/import.html
- Analyst observation The current client code JSON-serializes mnemonic and password for POST /api/import.
- Analyst observation The current client code JSON-serializes privateKey, coin, and password for POST /api/import_private_key.
- Analyst observation No real seed phrase, private key, PIN, wallet, or funds were submitted.
- File SHA-256 bd98c1f45073509be5126e337d233d13340f5520cbc719eb04090b092de7a550
The publicly retrievable administrator-interface source remains unchanged from the prior review. It still provides a workflow that sends a selected wallet identifier and administrator secret to POST /api/admin/decrypt_seed, receives a mnemonic, displays it, and enables copying it.
-
HTTP status
200 - Public artifact URL https://prunebit.com/admin_wallets.html
- Analyst observation The reviewed administrator-interface code posts wallet_id and secret_key to /api/admin/decrypt_seed and displays data.mnemonic on success.
- Analyst observation No administrator authentication or seed-decryption request was attempted.
- File SHA-256 93389e0dfdf8df6c6b48cdfa3b6e7f968c4201cdc7f536ad6020e414202da772
PruneBit corrected two material assurance problems from the prior review. The proof-of-reserves API now says that the service is non-custodial, makes no reserve claim, and lists no cold wallets. The security-audit API now says that no independent third-party audit has been completed and lists no certifications. The former advertised report paths still return HTTP 404, but the current APIs no longer present them as evidence.
-
HTTP status
200 - Public artifact URL https://prunebit.com/api/proof-of-reserves
- Public artifact URL https://prunebit.com/api/security-audit-info
- Page element PruneBit is a non-custodial wallet: it never holds user funds, so no reserve backing is required or claimed.
- Page element No independent third-party security audit has been completed yet. The codebase is open for public review.
-
HTTP status
404 - File SHA-256 5ad241d0560bf7f91821cdfcda0ec5fd05913ede7d15a7efc690ee944f74d7b5
- File SHA-256 3da9d1b19843ae17ed6bcfe4b75f1ae4d5837c78498fa49af5ca06158dd46fb1
The site still serves the same 33,151,511-byte Android package as in the prior review. Its SHA-256 is unchanged. Exact public searches for that hash returned no indexed result. This is not a safety finding: the package was preserved by hash, but the current review did not establish a distinct malware payload or observed malicious execution from the package.
-
HTTP status
200 - Public artifact URL https://prunebit.com/Prunebit_app.apk
- MIME type application/vnd.android.package-archive
- Analyst observation The downloaded package contained 33151511 bytes.
- File SHA-256 91d9fd1c9c84936ff7897fa028de423fb186634201412f09c1effd65f87ad68a
- Analyst observation No specific malware payload, observed malicious execution, confirmed victim, or confirmed theft was established.
The exact ticket target is the registrable parent domain itself; the additional www host returned the same current page. URLScan indexed four public scans of the apex host from August 18 through 20 and none for www. A stored public view described the URLScan result as score 0 and one VirusTotal warning out of 91. OTX exposed four pulse references, all from PhishDestroy feeds rather than four independent sources. Exact Wayback apex and www lookups returned no saved HTTP 200 HTML snapshot.
- Public artifact URL https://urlscan.io/domain/prunebit.com
- Public artifact URL https://otx.alienvault.com/indicator/domain/prunebit.com
- Public artifact URL https://phishdestroy.io/domain/prunebit.com/
- Public artifact URL https://web.archive.org/web/*/https://prunebit.com/
- Analyst observation These public results are domain-level reputation or scan records; they do not identify a separately verified malicious APK sample, exact harmful URL, or observed wallet-theft transaction.
Scope and limitations
- The review covered the apex and www hosts, current public pages, client and administrator-interface code, public APIs, the downloadable Android package, DNS, TLS, public reputation indexes, URL-scan records, threat-intelligence references, and exact archive lookups at the recorded time.
- No real seed phrase, private key, PIN, wallet, transaction, or funds were submitted. The finding concerns the sensitive values explicitly placed in the current client requests.
- No administrator authentication or seed-decryption request was attempted. The operator-access finding concerns the capability explicitly implemented in the current publicly retrievable administrator-interface source.
- The Android package was preserved and compared by hash but was not executed in this review. Absence of an indexed exact-hash result does not establish that the package is safe.
- The exact ticket target prunebit.com is also the registrable parent domain. The www alias returned the same page; no separate user-supplied subdomain, path, or destination was available for a different object-specific verdict.
- External reputation results are separately controlled, mostly domain-level, and time-sensitive. They were recorded as context and did not determine this first-party verdict.
Help protect others by sharing this page on social media! The more people who know about prunebit.com, the fewer chances they have to deceive someone else. Help others evaluate prunebit.com by sharing this page on social media!