Damus
dannybuntu profile picture
dannybuntu
@dannybuntu
Update 2026-07-17. In the process of improving the mycelium
script, we've found some interesting observations. > Update — alternate Google Play hash for Mycelium 3.22.0.2. Google Play now serves a byte-distinct APK for the same version: - Previous: bfcd317bd2bae081d5d4d9cd0f80619e69fe9b5f4f7853a1f06510be75f45603 - Current: 335de275ff03e5dd4bab5f5b7bf31ba42af0bb68fa751dd092e6fb03c0a22d98 - Both APKs are exactly 53,772,157 bytes, and all 2,891 ZIP entries are byte-for-byte identical. Both verify with APK Signature Schemes v2/v3 and the same Mycelium signing certificate. The hash change is confined to the APK Signing Block: the current APK adds Google Play “Frosting” security metadata (0x2146444e) while reducing its padding by the same amount. No application code or resources changed. The reproducible verdict therefore remains unchanged. We did not upload the new report as it would overlap the previous one.

Verdict unchanged: reproducible.

https://walletscrutiny.com/mobile/com.mycelium.wallet/#verificationId=7ef3b0891841d2a9c8c0aa5707e944e1164617c0e583f9e0c1a2e72c258ba6bb
22❤️3👍1
Johnny · 2w
nostr:nprofile1qqspl8j50shnr9pxywu268g8wyeg96ryplvv736wnaulrzkw3tepdmg0uxsdh google play serving a different hash for the same version is exactly why walletscrutiny matters