A modified wallet can send your coins or your seed to a thief while looking normal. Verifying the download protects against fake websites, hacked mirrors and look-alike apps.
Two checks
- Checksum: the file's SHA-256 hash must match the official list. This proves the file was not altered or corrupted.
- Signature: the list of hashes must be signed by people you trust. Otherwise an attacker could swap both file and list.
Example: Bitcoin Core
- Download the release,
SHA256SUMSandSHA256SUMS.ascfrom bitcoincore.org. - Check that your file's hash appears in SHA256SUMS.
- Use GPG to verify SHA256SUMS.asc. The release is signed by several individuals; their keys are listed in the guix.sigs repository.
Why many signers matter
Bitcoin Core is built reproducibly with Guix: independent builders compile the same source code and must get bit-for-bit identical files. When several people sign the same hashes, you do not have to trust a single developer or server.
Practical habits
- Type addresses of wallet websites yourself or use bookmarks; do not trust ads or search results.
- Install mobile apps only from the developer's own link to the official store.
- Hardware wallets: buy directly from the maker, and let the device verify its own firmware.
"Don't trust, verify" applies to software as much as to the blockchain.