The Rainbow wallet crypto app is self custody for Ethereum and two dozen compatible networks, and it does not hold bitcoin at all. Your keys live on your phone, backed up by a password protected iCloud or Google Drive file and by a 12 word secret phrase. Rainbow cannot recover either one if you lose it.
Listen to this article, about 10 minutes. A synthetic voice reads the article and announces each section title as it begins; tables are read row by row and the questions at the end are left out.
Recorded 29 October 2026 from the article as published that day. Press a chapter to jump there; the highlighted line is what is playing. A play button sits beside every section heading, and once you scroll past this player a bar at the bottom of the screen keeps the controls in reach. Tap or click any sentence to hear the reading start from there.
On this page: what Rainbow’s own support pages say about its cloud backup password, the derivation path read from its public source code, and the dated backup fixes in its GitHub history.
Think you already know this? Five questions, one minute.
Every answer is on this page. Answer from what you know now; the page fills in the rest.
-
1. Which of these does Rainbow’s supported networks page list?
The page, dated 15 April 2026, lists Ethereum compatible networks only and warns against sending tokens on unlisted chains. Rainbow supported networks Read the section
-
2. What does Rainbow’s backup page say about backing up manually if you already use the cloud backup?
Rainbow recommends a written phrase kept separately as well as the cloud file, and says that without a backup there is no way to recover a wallet. Rainbow on backups Read the section
-
3. Why might an older Rainbow cloud backup refuse to open?
Rainbow’s restore guide says only one password is saved to the keychain and advises restoring an older backup first. Rainbow restore guide Read the section
-
4. Which derivation path does Rainbow’s source code set as its default?
The wallet library file in Rainbow’s public repository sets DEFAULT_HD_PATH to the standard Ethereum path, so its phrases restore in other Ethereum wallets. Rainbow wallet library code Read the section
-
5. What did Rainbow’s merged fix of 14 November 2025 address?
The merged pull request fixed password managers failing to save the backup password; it was a bug, not a breach. Rainbow pull request 6923 Read the section
Checked on 29 October 2026 against Rainbow’s own support pages, its public source code on GitHub and its App Store listing. Rainbow is the wallet with the cheerful gradients and the pleasant sounds, and most pages that rank for it spend their word count on how nice it feels. It does feel nice. This page is about the two things the nice feeling does not cover: which coins it can hold, and what happens to your keys when the phone is gone.
Does Rainbow Wallet hold bitcoin at all?
No. The App Store lists it as Rainbow, Ethereum Wallet, and the name is accurate. Rainbow’s supported networks page, dated 15 April 2026, lists Ethereum, Base, Optimism, Arbitrum, Polygon and about twenty other Ethereum compatible chains. Bitcoin is not among them, and the page warns that if a network is not listed you should not send tokens to your wallet address on that chain, because you will not see them in the app.
That matters to this site’s readers because a bitcoin address and a Rainbow address are different things. A Rainbow address starts with 0x. A bitcoin address starts with bc1, 3 or 1. Most bitcoin wallets will refuse to send to a 0x address at all, which is the software doing you a favour. What Rainbow can show you is a token on Ethereum that tracks the price of bitcoin. That token is issued by a company that holds the real bitcoin on its behalf, so you are trusting that issuer, which is a different arrangement from holding bitcoin yourself. If bitcoin is what you hold, Rainbow is simply the wrong tool, in the same way Phantom is mostly the wrong tool for anyone whose holdings are on bitcoin’s own network.
| Question | Rainbow | A bitcoin wallet |
|---|---|---|
| Address format | 0x followed by 40 characters | Starts bc1, 3 or 1 |
| Bitcoin on its own network | Not supported | Supported |
| Phrase standard | BIP39, 12 words by default | BIP39, usually 12 or 24 words |
| Derivation path | m/44’/60’/0’/0, the Ethereum standard | m/84’/0’/0′ for native SegWit, among others |
| Cloud backup | iCloud or Google Drive, password protected | Varies; many offer none |
Where does Rainbow keep your keys and your backup?
On your device. Rainbow describes itself as non custodial, meaning the company never sees your keys. Its page on exporting the secret phrase puts the stakes plainly: whoever has your secret phrase can control your wallet and steal everything inside of it. The phrase is the wallet; the app is just a window onto it.
Rainbow offers two backups and recommends doing both. The first is the cloud backup. Its backup page says you can back up instantly with the Backup feature, and when it finishes a green label reads Up to Date under Settings, then Wallets and Backup. On iPhone that file goes to iCloud; on Android, Rainbow’s restore guide names Restore from Google Drive. The file is protected by a backup password you choose when you first make the wallet.
The second is the manual backup: the secret phrase written on paper or another physical object, kept somewhere separate. The same backup page says it is recommended even if you use the cloud, and adds a sentence worth reading twice: if you do not back up your wallet, there is no way to recover it. The browser extension’s backup guide adds a detail people miss. Each wallet group has its own phrase, so backing up one group does not cover another.
| Backup method | Protects against | Fails when |
|---|---|---|
| Cloud file only | A lost or broken phone | You forget the backup password, or lose the Apple or Google account |
| Written phrase only | Lost phone, lost cloud account, forgotten password | The paper is lost, damaged or found by someone else |
| Both, kept apart | Almost every ordinary loss | Both are lost together, or the phrase is typed into a fake site |
What happens if you forget the Rainbow backup password?
The cloud file becomes very hard to open, and Rainbow cannot help. Rainbow’s restore guide asks for the backup password that you created when you originally made your wallet. It then explains a quirk that is easy to fall into: the app only saves one password to the phone’s keychain, so any backups encrypted with an older password may not be accessible once that password has been overwritten. Its advice is to restore an older backup first, so that all the wallet secrets end up in your latest backup file.
Put simply, if you have changed the backup password over the years, your oldest wallets may be sitting in a file that only the old password opens. The written phrase does not have that problem, which is the strongest reason to keep one. The restore guide also says restoring only overwrites wallets that lack their secrets, or adds wallets from the backup, so restoring should not wipe a wallet you already hold with its phrase. Write down any phrase you can still reveal before you try anyway; it costs five minutes.
Rainbow’s support team will not ask for your phrase, and its wallet safety page is there to say so. Anyone who messages you offering to restore a backup in exchange for the words is a thief. No genuine support process, from Rainbow or anyone else, ever needs them.
Rainbow backup checks
Built from Rainbow’s own help pages. Tick each one off on your own device. Nothing here asks for your phrase, and nothing should.
This checklist records nothing and sends nothing. A backup is only proven when you have restored from it, ideally on a spare device with a small balance.
Will a Rainbow secret phrase restore in another wallet?
Yes, for its Ethereum accounts, and here the source code settles what the help pages do not. Rainbow is open source under the GPL 3.0 licence, and the wallet library file in its GitHub repository, read on 29 October 2026, sets the default derivation path to m/44’/60’/0’/0, the same path MetaMask and most Ethereum wallets use, with each extra account adding a number on the end. The phrase itself comes from the standard bip39 library, which produces 12 words unless told otherwise.
So a Rainbow phrase typed into another Ethereum wallet app should show the same addresses, in the same order. Accounts that live on a Ledger connected to Rainbow are different: the code gives those a separate Ledger Live style path, and the keys stay on the Ledger in any case. And a Rainbow phrase restored into a bitcoin wallet will produce bitcoin addresses that have never held anything, because nothing was ever sent to them. That empty screen is expected, not a theft. If you are moving between Ethereum apps, our MetaMask secret recovery phrase guide covers the same restore from the other side.
The phrase goes into a wallet app or a hardware device you installed yourself, and nowhere else: not a website, not a form, not a tool that offers to check it for you. If you want a fuller treatment of storage, our recovery phrase guide covers the mistakes that actually lose coins.
What has gone wrong with Rainbow backups, according to its own code?
Nothing catastrophic that we could find, but the fix log is more honest than any review. Because Rainbow’s app code is public, its repairs are dated public records. Three merged fixes touch the backup directly. On 12 June 2025 the team merged a fix for backups stuck in a syncing state. On 14 November 2025 came a fix for password managers that would not save the backup password, which matters given the one password quirk above. On 21 May 2026 a fix replaced a confusing Not Enabled label on the cloud backup row.
None of these is a breach, and every wallet ships bugs. The useful reading is this: the cloud backup is software, software has bad weeks, and a green Up to Date label is a status message rather than a guarantee. The written phrase does not sync, does not need a password manager and has never had a pull request.
The one exploit we found touching Rainbow users came through a partner. Unchained reported on 16 January 2024 that the Socket bridging protocol, which Rainbow used for its bridge feature, was exploited for several million dollars, and that Rainbow paused bridging in its mobile app and browser extension. Socket urged users to revoke all transaction approvals. The lesson travels well beyond Rainbow: a token approval you signed months ago is still live until you revoke it.
Do the Rainbow points and RNBW token change any of this?
No, and they are not a reason to pick a wallet. Decrypt reported on 22 September 2025 that Rainbow’s points programme, running since late 2023, would convert into an on chain RNBW token. The airdrop pitch is the oldest trick in wallet marketing: use the app more and something might arrive later. This site does not cover tokens or rewards, and nothing about a points balance changes where your keys are or how you get them back. Scammers do love an airdrop, though. A site that asks for your phrase to claim one is stealing your wallet, every time.
If you are choosing a phone wallet for bitcoin itself, our hot wallet comparison sets the options side by side on the same terms, and our MetaMask review covers the Ethereum wallet most often compared with Rainbow. For the general question of who can move your coins, our explainer on non custodial wallets starts from first principles.
Frequently asked questions
Can I send bitcoin to my Rainbow wallet address?
No. Rainbow supports Ethereum and compatible networks only, and its address starts with 0x, which is not a bitcoin address. Most bitcoin wallets will refuse the send. If one somehow did, Rainbow could not show or move the coins.
Is the Rainbow iCloud backup encrypted?
Rainbow’s restore guide asks for the backup password you set when you made the wallet and describes older backups as encrypted with an older password, so the file is password protected. Rainbow’s pages checked on 29 October 2026 did not describe the encryption method in detail.
Can Rainbow support reset my backup password?
No. Rainbow is non custodial and never holds your keys or your password. If the password is lost, the written secret phrase is the way back in. Without either, Rainbow’s backup page says there is no way to recover the wallet.
How many words is a Rainbow secret phrase?
Twelve, by default. Rainbow’s open source code generates the phrase with the standard bip39 library, whose default is 12 words. Imported wallets keep whatever length they had, so a 24 word phrase from elsewhere still works in Rainbow.
Does the Rainbow browser extension share the phone backup?
Not automatically. The extension has its own password, which Rainbow says cannot be reset, and its own guide on backing up each wallet group. To move a wallet between them you import its secret phrase into the other.
Is Rainbow open source?
Yes. The mobile app’s code is published on GitHub under the GPL 3.0 licence and was still being updated on 29 October 2026. Open code lets anyone check details such as the derivation path, though it does not prove the app store build matches it.
Finished the page? The same five questions from the top, to see what stuck.
This article is general information about wallet security and is not financial advice. Nothing here is a recommendation to buy, sell or hold anything, or to use any token, points, earn or yield feature. Speak to a suitably qualified professional about your own situation, and remember that in self custody the security decisions are yours alone.
Leave a Reply