Brave embeds a cryptocurrency wallet right in the browser

Brave, the browser maker who pioneered the Brave Attention Token (BAT) as a way of paying you for your attention, has taken another unique step: The latest version of the browser has a cryptocurrency wallet built right into it.

Brave version 1.32 includes a dedicated wallet built right into the browser, in which users can store their private keys for various cryptocurrency holdings. (Read our review of Brave 1.0.) The company claims that the direct integration is more secure than a third-party browser plugin, but also allows users to connect with hardware wallet devices like Trezor and Ledger. Brave’s wallet also provides real-time market information as well as the ability to buy and pay via various cryptocurrencies.

The new Brave Wallet replaces the legacy crypto wallet found in earlier versions of the browser, Brave said. It can be accessed by clicking the small “wallet” icon in the upper right-hand corner of the browser itself. If you set up the new wallet, Brave will ask you to import a Metamask wallet or other soft custody wallet. When that’s complete, Brave will send you a series of words, which you’ll then have to write down and store as an account recovery mechanism.

Brave lists the following features of the new wallet:

• See live and historical market data (graphs with price data powered by CoinGecko)
• Find the best price match against a list of providers with built-in swap functionality 
• Send and receive assets
• Buy with fiat via Wyre 
• Interact with DApps for any EVM-compatible network
• Manage a portfolio—with non-fungible token (NFT) and multi-chain support 
• Easily import a wallet from MetaMask and self-custody wallets, or Brave’s legacy Crypto Wallets extension, or hardware wallets such as Trezor and Ledger (no Ledger Live required)
• Send and receive NFTs 
• Support for all EVM (Ethereum Virtual Machine) compatible chains (Polygon, xDai, Avalanche, and others)

We asked Brave to explain why the Brave Wallet was superior to other solutions, and how the private keys were protected. Brian Bondy, the company’s chief technical officer and co-founder, provided us with a statement in response.

“The Brave Wallet, in the same way as hardware devices, implements its own BIP32 Hierarchical Deterministic (HD) wallet (BIP32 HD wallet). The funds are always stored on the blockchain, but the keys to unlock those funds are stored in the Brave Wallet.”

Bondy also said that integrating the wallet into the browser prevents users from being tricked by spoofing attacks—for example, loading their private keys into a plugin which could have a hard-coded key that an attacker could also access, stealing the private keys and the funds that they connected to. Those plugins may also have code dependencies that could produce security audit errors, Bondy added.

“Finally, extensions cannot paint on the ‘full canvas’ of the browser’s user interface, especially not the address bar or unspoofable toolbar,” Bondy said. “Brave Wallet can make full use of this user-interface area to help protect users from being tricked. In Brave, Dapp permissions tie into the same Chromium permission manager as other permissions such as geolocations; whereas extensions need to roll their own implementations.”