{"id":467,"date":"2026-10-07T09:33:42","date_gmt":"2026-10-07T09:33:42","guid":{"rendered":"https:\/\/getbitcoin.guide\/articles\/?p=467"},"modified":"2026-10-07T09:39:45","modified_gmt":"2026-10-07T09:39:45","slug":"arculus-wallet-review","status":"publish","type":"post","link":"https:\/\/getbitcoin.guide\/articles\/arculus-wallet-review\/","title":{"rendered":"Arculus Wallet: Three Wrong PINs and One Odd Seed Path"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>The Arculus wallet is a metal card that keeps your keys in a secure element and signs only when you tap it to your phone and enter a six digit PIN. The card has no screen, three wrong PINs wipe it, and the Bitcoin path it uses is not the one other wallets check first.<\/strong><\/p>\n\n\n\n<div class=\"msq-audio\" data-article=\"arculus-wallet-review\" data-minutes=\"12\">\n<style>.msq-audio{margin:1.25em 0 1.75em;padding:16px 18px;background:#EEF3F8;border:1px solid #CBD8E6;border-radius:12px}\n.msq-audio-lead{margin:0 0 8px;font-size:.95em}.msq-audio audio{width:100%;margin:0 0 12px;display:block}\n.msq-toc-title{margin:0 0 6px;font-weight:700}.msq-toc ol{margin:0;padding:0;list-style:none}\n.msq-toc li{display:flex;gap:10px;align-items:center;padding:6px 6px;border-bottom:1px solid #CBD8E6;border-radius:8px}\n.msq-toc li:last-child{border-bottom:0}.msq-toc li.is-active{background:#fff}\n.msq-toc-play{flex:0 0 auto;width:30px;height:30px;border-radius:50%;border:0;background:#1F4E79;color:#fff;font:inherit;font-size:.72em;line-height:30px;padding:0;cursor:pointer}\n.msq-toc-play.is-playing{background:#B4531A}\n.msq-toc-time{flex:0 0 auto;min-width:3.1em;font-variant-numeric:tabular-nums;color:#4A5560;font-size:.9em}\n.msq-toc a{color:#1B1F24;text-decoration:none;line-height:1.35}.msq-toc li.is-active a{font-weight:700;color:#1F4E79}\n.msq-audio-note{margin:10px 0 0;font-size:.82em;color:#4A5560}\nh2.wp-block-heading[id]{scroll-margin-top:24px}\n.msq-hplay{display:inline-block;vertical-align:middle;width:26px;height:26px;margin:0 0 0 10px;border-radius:50%;border:0;background:#1F4E79;cursor:pointer;padding:0;position:relative;top:-2px}\n.msq-hplay::before{content:'\u25b6\ufe0e';display:block;color:#fff;font-size:11px;line-height:26px;text-align:center}\n.msq-hplay.is-playing{background:#B4531A}.msq-hplay.is-playing::before{content:'\u2016';font-size:13px;font-weight:700}\n.msq-bar{position:fixed;left:0;right:0;bottom:0;z-index:9000;display:flex;align-items:center;gap:10px;padding:8px 12px;padding-bottom:calc(8px + env(safe-area-inset-bottom));background:#FFFFFF;border-top:1px solid #CBD8E6;box-shadow:0 -4px 16px rgba(0,0,0,.08);font-size:.92em;color:#1B1F24;transition:transform .2s ease}\n.msq-bar.is-hidden{transform:translateY(130%)}\n.msq-bar-play{display:inline-flex;align-items:center;gap:8px;border:0;border-radius:999px;background:#1F4E79;color:#fff;font:inherit;font-weight:700;padding:8px 14px 8px 12px;cursor:pointer;white-space:nowrap}\n.msq-bar-play.is-playing{background:#B4531A}\n.msq-bar-icon::before{content:'\u25b6\ufe0e';font-size:12px}.msq-bar-play.is-playing .msq-bar-icon::before{content:'\u2016';font-size:14px;font-weight:700}\n.msq-bar-chapter{flex:1 1 auto;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}\n.msq-bar-time{flex:0 0 auto;font-variant-numeric:tabular-nums;color:#4A5560;font-size:.9em}\n.msq-bar-rate,.msq-bar-close{flex:0 0 auto;border:1px solid #CBD8E6;background:#fff;color:#1B1F24;font:inherit;font-size:.85em;line-height:1;border-radius:8px;padding:7px 9px;cursor:pointer}\n.msq-bar-close::before{content:'\u2715'}\n.msq-bar.msq-bar-pill{left:auto;right:14px;bottom:14px;padding:6px;padding-bottom:6px;border:1px solid #CBD8E6;border-radius:999px;box-shadow:0 6px 20px rgba(0,0,0,.15)}\n.msq-bar.msq-bar-pill .msq-bar-chapter,.msq-bar.msq-bar-pill .msq-bar-time,.msq-bar.msq-bar-pill .msq-bar-rate{display:none}\nbody.msq-has-bar{padding-bottom:76px}\n@media (max-width:600px){.msq-bar-time{display:none}.msq-bar{gap:8px;padding-left:10px;padding-right:10px}}\n.msq-s.msq-now{background:#EEF3F8;box-shadow:0 2px 0 #1F4E79;border-radius:2px}\ntr.msq-now td,tr.msq-now th{background:#EEF3F8;box-shadow:inset 0 -2px 0 #1F4E79}\n@media (hover:hover){.msq-s,tr[data-i]{cursor:pointer}.msq-s:hover{background:#EEF3F8}}<\/style>\n<script type=\"application\/ld+json\">{\"@context\":\"https:\/\/schema.org\",\"@type\":\"AudioObject\",\"@id\":\"https:\/\/getbitcoin.guide\/articles\/arculus-wallet-review\/#audio\",\"name\":\"Arculus Wallet: Three Wrong PINs and One Odd Seed Path, read aloud\",\"description\":\"Synthetic voice reading of the article, recorded 7 October 2026.\",\"contentUrl\":\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/arculus-wallet-review-audio-202610071509.mp3\",\"encodingFormat\":\"audio\/mpeg\",\"duration\":\"PT12M3S\",\"uploadDate\":\"2026-10-07\",\"inLanguage\":\"en-GB\",\"isAccessibleForFree\":true,\"mainEntityOfPage\":\"https:\/\/getbitcoin.guide\/articles\/arculus-wallet-review\/\",\"hasPart\":[{\"@type\":\"Clip\",\"name\":\"Arculus Wallet: Three Wrong PINs and One Odd Seed Path\",\"startOffset\":0,\"endOffset\":43},{\"@type\":\"Clip\",\"name\":\"How does the Arculus wallet actually sign a transaction?\",\"startOffset\":43,\"endOffset\":129,\"url\":\"https:\/\/getbitcoin.guide\/articles\/arculus-wallet-review\/#how-does-the-arculus-wallet-actually-sign-a-transaction\"},{\"@type\":\"Clip\",\"name\":\"What does the card show you before you approve a payment?\",\"startOffset\":129,\"endOffset\":260,\"url\":\"https:\/\/getbitcoin.guide\/articles\/arculus-wallet-review\/#what-does-the-card-show-you-before-you-approve-a-payment\"},{\"@type\":\"Clip\",\"name\":\"What happens after three wrong PIN entries?\",\"startOffset\":260,\"endOffset\":332,\"url\":\"https:\/\/getbitcoin.guide\/articles\/arculus-wallet-review\/#what-happens-after-three-wrong-pin-entries\"},{\"@type\":\"Clip\",\"name\":\"If the card or the phone is lost, what actually gets you back in?\",\"startOffset\":332,\"endOffset\":390,\"url\":\"https:\/\/getbitcoin.guide\/articles\/arculus-wallet-review\/#if-the-card-or-the-phone-is-lost-what-actually-gets-you-back-in\"},{\"@type\":\"Clip\",\"name\":\"Why can a restored Arculus phrase show no Bitcoin at all?\",\"startOffset\":390,\"endOffset\":489,\"url\":\"https:\/\/getbitcoin.guide\/articles\/arculus-wallet-review\/#why-can-a-restored-arculus-phrase-show-no-bitcoin-at-all\"},{\"@type\":\"Clip\",\"name\":\"Why is an Arculus firmware update always a phishing tell?\",\"startOffset\":489,\"endOffset\":584,\"url\":\"https:\/\/getbitcoin.guide\/articles\/arculus-wallet-review\/#why-is-an-arculus-firmware-update-always-a-phishing-tell\"},{\"@type\":\"Clip\",\"name\":\"What do people who use Arculus actually report?\",\"startOffset\":584,\"endOffset\":723,\"url\":\"https:\/\/getbitcoin.guide\/articles\/arculus-wallet-review\/#what-do-people-who-use-arculus-actually-report\"}],\"contentSize\":\"5.1 MB\"}<\/script>\n<p class=\"msq-audio-lead\"><strong>Listen to this article<\/strong>, about 12 minutes. A synthetic voice reads the article and announces each section title as it begins; tables are read row by row and the questions at the end are left out.<\/p>\n<audio class=\"msq-audio-player\" controls preload=\"metadata\" src=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/arculus-wallet-review-audio-202610071509.mp3\"><\/audio>\n<nav class=\"msq-toc\" aria-label=\"In this article\"><p class=\"msq-toc-title\">In this article<\/p>\n<ol>\n<li data-start=\"0.0\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"0.0\" aria-label=\"Play from: Arculus Wallet: Three Wrong PINs and One Odd Seed Path\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">0:00<\/span><a href=\"#top\">Arculus Wallet: Three Wrong PINs and One Odd Seed Path<\/a><\/li>\n<li data-start=\"42.58\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"42.58\" aria-label=\"Play from: How does the Arculus wallet actually sign a transaction?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">0:43<\/span><a href=\"#how-does-the-arculus-wallet-actually-sign-a-transaction\">How does the Arculus wallet actually sign a transaction?<\/a><\/li>\n<li data-start=\"129.04\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"129.04\" aria-label=\"Play from: What does the card show you before you approve a payment?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">2:09<\/span><a href=\"#what-does-the-card-show-you-before-you-approve-a-payment\">What does the card show you before you approve a payment?<\/a><\/li>\n<li data-start=\"260.46\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"260.46\" aria-label=\"Play from: What happens after three wrong PIN entries?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">4:20<\/span><a href=\"#what-happens-after-three-wrong-pin-entries\">What happens after three wrong PIN entries?<\/a><\/li>\n<li data-start=\"331.72\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"331.72\" aria-label=\"Play from: If the card or the phone is lost, what actually gets you back in?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">5:32<\/span><a href=\"#if-the-card-or-the-phone-is-lost-what-actually-gets-you-back-in\">If the card or the phone is lost, what actually gets you back in?<\/a><\/li>\n<li data-start=\"390.3\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"390.3\" aria-label=\"Play from: Why can a restored Arculus phrase show no Bitcoin at all?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">6:30<\/span><a href=\"#why-can-a-restored-arculus-phrase-show-no-bitcoin-at-all\">Why can a restored Arculus phrase show no Bitcoin at all?<\/a><\/li>\n<li data-start=\"489.32\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"489.32\" aria-label=\"Play from: Why is an Arculus firmware update always a phishing tell?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">8:09<\/span><a href=\"#why-is-an-arculus-firmware-update-always-a-phishing-tell\">Why is an Arculus firmware update always a phishing tell?<\/a><\/li>\n<li data-start=\"583.58\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"583.58\" aria-label=\"Play from: What do people who use Arculus actually report?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">9:44<\/span><a href=\"#what-do-people-who-use-arculus-actually-report\">What do people who use Arculus actually report?<\/a><\/li>\n<\/ol><\/nav>\n<p class=\"msq-audio-note\">Recorded 7 October 2026 from the article as published that day. Press a chapter to jump there; the highlighted line is what is playing. A play button sits beside every section heading, and once you scroll past this player a bar at the bottom of the screen keeps the controls in reach. Tap or click any sentence to hear the reading start from there.<\/p>\n<script>var MSQ_SENT = [[0.0,\"h\",\"arculuswalletthreewrongp\",44],[4.24,\"p\",\"thearculuswalletisametal\",116],[11.8,\"p\",\"thecardhasnoscreenthreew\",94],[19.64,\"p\",\"onthispagethesigningpath\",267],[42.58,\"h\",\"howdoesthearculuswalleta\",47],[45.82,\"p\",\"arculusistwothingsthaton\",126],[54.98,\"p\",\"keysaregeneratedonthecar\",122],[65.7,\"p\",\"thepaperisbluntaboutthed\",142],[75.1,\"p\",\"theappholdsyouraccountpu\",46],[78.82,\"p\",\"tosendcoinsyouenterthesi\",110],[86.94,\"p\",\"thecardchecksthepinsigns\",43],[91.18,\"p\",\"arculuscallsthisthreefac\",119],[101.98,\"p\",\"twodetailsinthatpapermat\",57],[105.7,\"p\",\"theradioisnearfieldcommu\",119],[114.26,\"p\",\"andthecardshipslockedsot\",52],[118.94,\"p\",\"holdontothatsecondone\",21],[120.58,\"p\",\"itdecidesthewholephishin\",112],[129.04,\"h\",\"whatdoesthecardshowyoube\",46],[131.84,\"p\",\"nothing\",7],[133.0,\"p\",\"thereisnodisplay\",16],[134.36,\"p\",\"thecomponentsthevendorli\",125],[144.52,\"p\",\"noscreenappearsinthatlis\",56],[148.36,\"p\",\"thatmattersmorethantheaf\",43],[151.44,\"p\",\"onadevicewithadisplaythe\",138],[162.24,\"p\",\"witharculustheonlyplacey\",107],[169.64,\"p\",\"thesecurityofthetapisexc\",30],[172.24,\"p\",\"thesecurityofwhatyouaret\",63],[176.8,\"p\",\"tobefairtothevendorthisi\",153],[190.04,\"t\",\"arculuskeycard\",154],[203.84,\"t\",\"ledgernanosplus\",168],[221.24,\"t\",\"trezorsafe5\",167],[240.08,\"p\",\"readthesecondcolumnandth\",75],[245.64,\"p\",\"yougiveupondeviceverific\",140],[255.04,\"p\",\"thelongerversionofthatar\",59],[260.46,\"h\",\"whathappensafterthreewro\",36],[263.22,\"p\",\"thecardlocksandwipes\",20],[265.26,\"p\",\"thevendorpaperstatesthat\",154],[276.62,\"p\",\"thesupportarticleonlocke\",167],[288.58,\"p\",\"threestrikesisthesamebud\",41],[291.7,\"p\",\"thedifferenceishowofteny\",38],[293.86,\"p\",\"asixdigitpinyoulastusedf\",163],[304.26,\"p\",\"trezorssixteenattemptswi\",64],[308.66,\"p\",\"theyaresimplykindertoahu\",33],[311.34,\"p\",\"nothingislostifyourrecov\",67],[316.9,\"p\",\"arculusshowsthe12or24wor\",136],[328.22,\"p\",\"itiskeptonneitherthecard\",35],[331.72,\"h\",\"ifthecardorthephoneislos\",50],[335.44,\"p\",\"therecoveryphraseinevery\",30],[338.44,\"p\",\"thesupportpageonalostors\",157],[349.56,\"p\",\"therestoreinstructionsde\",97],[356.92,\"p\",\"soplanonneedingthemeveni\",53],[360.64,\"p\",\"twopracticalnotestherevi\",35],[363.36,\"p\",\"theappsupportsmorethanon\",200],[382.12,\"p\",\"asparecarddoesnotreplace\",38],[385.12,\"p\",\"itdoesremovetheweekyouwo\",72],[390.3,\"h\",\"whycanarestoredarculusph\",46],[394.18,\"p\",\"thisisthemostusefulthing\",84],[399.66,\"p\",\"arecoveryphrasedoesnotco\",42],[403.22,\"p\",\"itcontainsaseedandwallet\",104],[410.1,\"p\",\"twowalletswiththesamewor\",99],[416.74,\"p\",\"arculusisexplicitaboutth\",47],[419.98,\"p\",\"itspageonrestoringanarcu\",183],[433.18,\"p\",\"mostwalletsreachforthebi\",44],[437.46,\"p\",\"thevendoraddsthatmanywal\",67],[443.54,\"p\",\"picturethebadevening\",20],[445.02,\"p\",\"thecardisgoneyoutypetwel\",80],[450.58,\"p\",\"nothinghasmoved\",15],[452.94,\"p\",\"thenewwalletislookingdow\",43],[455.7,\"p\",\"peopleinthatpositionsear\",84],[461.74,\"p\",\"sowritethepathdownbeside\",75],[468.62,\"p\",\"version3120oftheapprelea\",125],[478.02,\"p\",\"nobodyshouldevertypearec\",88],[484.62,\"p\",\"thereisnolegitimatesitua\",47],[489.32,\"h\",\"whyisanarculusfirmwareup\",47],[492.52,\"p\",\"becausethereisnosuchthin\",25],[494.32,\"p\",\"thecardshipslockedandits\",128],[503.16,\"p\",\"followthattoitsconclusio\",74],[508.04,\"p\",\"anymessagetellingyoutoup\",95],[515.36,\"p\",\"theappupdates\",13],[517.28,\"p\",\"thecarddoesnotever\",18],[519.8,\"p\",\"theappgenuinelydoesupdat\",62],[523.96,\"p\",\"theappstorelistingshowed\",143],[540.68,\"p\",\"thoseupdatesarrivethroug\",70],[545.24,\"p\",\"theattacksarerealanddocu\",30],[547.56,\"p\",\"acomplaintpublishedonsca\",251],[569.32,\"p\",\"thatisonepersonsreporton\",92],[575.36,\"p\",\"themethodisnotindoubt\",21],[577.04,\"p\",\"arculussownguidanceonrec\",92],[583.58,\"h\",\"whatdopeoplewhousearculu\",39],[586.46,\"p\",\"wereadthetenreviewsshown\",134],[598.22,\"p\",\"thebalanceismostlypositi\",99],[604.38,\"p\",\"aonestarreviewdated13jul\",115],[613.5,\"p\",\"atwostarreviewdated4sept\",112],[622.78,\"p\",\"tworeviewsfrom15january2\",112],[634.22,\"p\",\"afivestarreviewdated15ma\",113],[643.62,\"p\",\"ajanuary2023reviewcallst\",81],[650.1,\"p\",\"thoseareaccountsnotmeasu\",98],[657.42,\"p\",\"thepatternthatholdsupist\",148],[667.9,\"p\",\"thatmatchesthereviewsalm\",91],[674.34,\"p\",\"wheretheaccountsandthedo\",72],[679.54,\"p\",\"supportframesazeroreadin\",42],[682.38,\"p\",\"thederivationpathpagesho\",98],[689.58,\"p\",\"oneclaimwecouldnotchecka\",172],[702.54,\"p\",\"foracustomerdataleakthat\",73],[707.7,\"p\",\"arculusalsocarriesotherc\",209]];\n(function(){\n  function init(){\n  var root = document.querySelector('.msq-audio'); if (!root) { return; }\n  var audio = root.querySelector('audio'), items = Array.prototype.slice.call(root.querySelectorAll('.msq-toc li'));\n  var starts = items.map(function(li){ return parseFloat(li.getAttribute('data-start')) || 0; });\n  var names = items.map(function(li){ return li.querySelector('a').textContent; });\n  var anchors = items.map(function(li){ var h = li.querySelector('a').getAttribute('href') || ''; return (h.charAt(0) === '#' && h !== '#top') ? document.getElementById(h.slice(1)) : null; });\n  var article = root.getAttribute('data-article') || location.pathname, minutes = root.getAttribute('data-minutes') || '';\n  var marks = {}, started = false, pausedAt = -1, closed = false, ended = false;\n  var RATES = [1, 1.25, 1.5], rate = 1;\n  try { var saved = parseFloat(localStorage.getItem('msq-audio-rate')); if (RATES.indexOf(saved) >= 0) { rate = saved; } } catch (e) {}\n  audio.playbackRate = rate;\n  function track(name, extra){ try { if (typeof gtag === 'function') { var p = { article: article }; for (var k in extra) { p[k] = extra[k]; } gtag('event', name, p); } } catch (e) {} }\n  function current(){ var t = audio.currentTime, idx = 0; for (var i = 0; starts.length > i; i += 1) { if (t + 0.25 >= starts[i]) { idx = i; } } return idx; }\n  function onScreen(){\n    var line = window.innerHeight \/ 3, idx = 0;\n    for (var i = 0; anchors.length > i; i += 1) { var el = anchors[i]; if (el && line >= el.getBoundingClientRect().top) { idx = i; } }\n    return idx;\n  }\n  function fmt(s){ s = Math.max(0, Math.round(s || 0)); var m = Math.floor(s \/ 60), r = s % 60; return m + ':' + (10 > r ? '0' : '') + r; }\n  function play(from, source){\n    if (from !== null) { audio.currentTime = from; }\n    var p = audio.play(); if (p && p.catch) { p.catch(function(){}); }\n    track(from === null ? 'audio_resume' : 'audio_chapter', { chapter: names[current()], start: Math.round(audio.currentTime), source: source });\n  }\n  var hbtns = anchors.map(function(el, i){\n    if (!el) { return null; }\n    var b = document.createElement('button'); b.type = 'button'; b.className = 'msq-hplay'; b.setAttribute('aria-label', 'Play this section: ' + names[i]);\n    b.addEventListener('click', function(){\n      if (!audio.paused && current() === i) { audio.pause(); track('audio_pause', { source: 'heading' }); return; }\n      play(starts[i], 'heading');\n    });\n    el.appendChild(b); return b;\n  });\n  var bar = document.createElement('div'); bar.className = 'msq-bar msq-bar-pill is-hidden'; bar.setAttribute('role', 'region'); bar.setAttribute('aria-label', 'Audio player');\n  var playBtn = document.createElement('button'); playBtn.type = 'button'; playBtn.className = 'msq-bar-play';\n  var icon = document.createElement('span'); icon.className = 'msq-bar-icon'; icon.setAttribute('aria-hidden', 'true');\n  var label = document.createElement('span'); label.className = 'msq-bar-label';\n  playBtn.appendChild(icon); playBtn.appendChild(label);\n  var chap = document.createElement('span'); chap.className = 'msq-bar-chapter';\n  var clock = document.createElement('span'); clock.className = 'msq-bar-time';\n  var rateBtn = document.createElement('button'); rateBtn.type = 'button'; rateBtn.className = 'msq-bar-rate'; rateBtn.setAttribute('aria-label', 'Playback speed');\n  var closeBtn = document.createElement('button'); closeBtn.type = 'button'; closeBtn.className = 'msq-bar-close'; closeBtn.setAttribute('aria-label', 'Close the audio bar');\n  bar.appendChild(playBtn); bar.appendChild(chap); bar.appendChild(clock); bar.appendChild(rateBtn); bar.appendChild(closeBtn);\n  document.body.appendChild(bar);\n  function showRate(){ rateBtn.textContent = (rate === 1 ? '1' : String(rate)) + 'x'; }\n  showRate();\n  rateBtn.addEventListener('click', function(){\n    rate = RATES[(RATES.indexOf(rate) + 1) % RATES.length]; audio.playbackRate = rate; showRate();\n    try { localStorage.setItem('msq-audio-rate', String(rate)); } catch (e) {}\n    track('audio_rate', { rate: rate });\n  });\n  closeBtn.addEventListener('click', function(){\n    closed = true; if (!audio.paused) { audio.pause(); } paint(); track('audio_bar_close', {});\n  });\n  function mode(){\n    if (!audio.paused) { return 'pause'; }\n    if (ended) { return 'again'; }\n    if (!started) { return 'listen'; }\n    return (pausedAt === onScreen()) ? 'resume' : 'section';\n  }\n  playBtn.addEventListener('click', function(){\n    var m = mode();\n    if (m === 'pause') { audio.pause(); track('audio_pause', { source: 'bar' }); return; }\n    if (m === 'again') { ended = false; play(0, 'bar'); return; }\n    if (m === 'resume') { play(null, 'bar'); return; }\n    play(starts[onScreen()], 'bar');\n  });\n  function paint(){\n    var idx = current(), playing = !audio.paused, m = mode();\n    items.forEach(function(li, i){\n      var on = (i === idx) && playing, b = li.querySelector('.msq-toc-play'), a = li.querySelector('a');\n      li.classList.toggle('is-active', on); b.classList.toggle('is-playing', on);\n      b.textContent = on ? '\u2016' : '\u25b6\ufe0e';\n      b.setAttribute('aria-label', (on ? 'Pause: ' : 'Play from: ') + a.textContent);\n    });\n    hbtns.forEach(function(b, i){ if (b) { var on = (i === idx) && playing; b.classList.toggle('is-playing', on); b.setAttribute('aria-label', (on ? 'Pause this section: ' : 'Play this section: ') + names[i]); } });\n    playBtn.classList.toggle('is-playing', playing);\n    label.textContent = m === 'pause' ? 'Pause' : m === 'again' ? 'Play again' : m === 'resume' ? 'Resume' : m === 'section' ? 'Play this section' : 'Listen, ' + minutes + ' min';\n    playBtn.setAttribute('aria-label', label.textContent);\n    chap.textContent = started ? names[(playing || m === 'resume') ? idx : onScreen()] : '';\n    clock.textContent = started ? fmt(audio.currentTime) + ' \/ ' + fmt(audio.duration) : '';\n    bar.classList.toggle('msq-bar-pill', !started);\n    var show = !closed && (started || 0 > root.getBoundingClientRect().bottom);\n    bar.classList.toggle('is-hidden', !show);\n    document.body.classList.toggle('msq-has-bar', show);\n  }\n  root.addEventListener('click', function(e){\n    var b = e.target.closest ? e.target.closest('.msq-toc-play') : null; if (!b) { return; }\n    var li = b.parentNode, s = parseFloat(b.getAttribute('data-start')) || 0;\n    if (!audio.paused && current() === items.indexOf(li)) { audio.pause(); track('audio_pause', { source: 'index' }); return; }\n    play(s, 'index');\n  });\n  audio.addEventListener('play', function(){ ended = false; closed = false; if (!started) { started = true; track('audio_play', { minutes: Math.round((audio.duration || 0) \/ 60) }); } paint(); });\n  audio.addEventListener('pause', function(){ pausedAt = current(); paint(); });\n  audio.addEventListener('timeupdate', function(){\n    paint();\n    if (audio.duration > 0) {\n      var pct = Math.floor(audio.currentTime \/ audio.duration * 100);\n      [25, 50, 75].forEach(function(m){ if (pct >= m && !marks[m]) { marks[m] = true; track('audio_progress', { percent: m }); } });\n    }\n  });\n  audio.addEventListener('ended', function(){ ended = true; track('audio_complete', {}); paint(); });\n  var ticking = false;\n  function onScroll(){ if (ticking) { return; } ticking = true; setTimeout(function(){ ticking = false; paint(); }, 80); }\n  window.addEventListener('scroll', onScroll, { passive: true }); window.addEventListener('resize', onScroll);\n  paint();\n  }\n  if (document.readyState === 'loading') { document.addEventListener('DOMContentLoaded', init); } else { init(); }\n})();\n\n(function(){\n  function start(){\n    var root = document.querySelector('.msq-audio'), audio = root ? root.querySelector('audio') : null;\n    var map = (typeof MSQ_SENT !== 'undefined') ? MSQ_SENT : [];\n    if (!root || !audio || !map.length) { return; }\n    var scope = root.closest('main') || root.closest('article') || root.closest('.entry-content') || document.body;\n    var SKIP = '.msq-audio,.msq,.msq-tool,.msq-end,.msq-bar,script,style,noscript,figcaption,#rank-math-faq,.rank-math-block,nav,header,footer';\n    function norm(s){ return s.toLowerCase().replace(\/[^a-z0-9]+\/g, ''); }\n    var nodes = [], stream = '', walker = document.createTreeWalker(scope, NodeFilter.SHOW_TEXT, null), n;\n    while ((n = walker.nextNode())) {\n      var el = n.parentElement; if (!el || el.closest(SKIP)) { continue; }\n      var raw = n.nodeValue, keep = [], norms = '';\n      for (var i = 0; raw.length > i; i += 1) { var c = raw.charAt(i).toLowerCase(); if (\/[a-z0-9]\/.test(c)) { keep.push(i); norms += c; } }\n      if (!norms) { continue; }\n      nodes.push({ node: n, a: stream.length, b: stream.length + norms.length, keep: keep });\n      stream += norms;\n    }\n    var segs = [], cursor = 0, lastRow = null;\n    map.forEach(function(m, idx){\n      var kind = m[1], f = m[2], len = m[3];\n      if (kind === 't') {\n        var rows = scope.querySelectorAll('tr'), after = !lastRow;\n        for (var r = 0; rows.length > r; r += 1) {\n          var tr = rows[r];\n          if (!after) { if (tr === lastRow) { after = true; } continue; }\n          var cell = tr.querySelector('td,th');\n          if (cell && norm(cell.textContent).indexOf(f) === 0) { tr.setAttribute('data-i', idx); lastRow = tr; break; }\n        }\n        return;\n      }\n      var p = stream.indexOf(f, cursor); if (0 > p) { return; }\n      segs.push({ i: idx, a: p, b: Math.min(p + len, stream.length) }); cursor = p + len;\n    });\n    var si = 0;\n    nodes.forEach(function(nd){\n      var frag = document.createDocumentFragment(), raw = nd.node.nodeValue, rawPos = 0, any = false;\n      for (var k = si; segs.length > k; k += 1) {\n        var sg = segs[k]; if (sg.a >= nd.b) { break; } if (nd.a >= sg.b) { continue; }\n        var s = Math.max(sg.a, nd.a), e = Math.min(sg.b, nd.b);\n        var rs = nd.keep[s - nd.a], re2 = nd.keep[e - nd.a - 1] + 1;\n        if (rs > rawPos) { frag.appendChild(document.createTextNode(raw.slice(rawPos, rs))); }\n        var span = document.createElement('span'); span.className = 'msq-s'; span.setAttribute('data-i', sg.i); span.textContent = raw.slice(rs, re2);\n        frag.appendChild(span); rawPos = re2; any = true;\n        if (sg.b > nd.b) { break; }\n      }\n      while (segs.length > si && nd.b >= segs[si].b) { si += 1; }\n      if (!any) { return; }\n      if (raw.length > rawPos) { frag.appendChild(document.createTextNode(raw.slice(rawPos))); }\n      nd.node.parentNode.replaceChild(frag, nd.node);\n    });\n    var starts = map.map(function(m){ return m[0]; }), curIdx = -1, lastUser = 0, timer = null, autoUntil = 0, dragging = false;\n    function idxAt(t){ var lo = 0, hi = starts.length; while (hi > lo + 1) { var mid = (lo + hi) >> 1; if (t + 0.15 >= starts[mid]) { lo = mid; } else { hi = mid; } } return (t + 0.15 >= starts[0]) ? lo : -1; }\n    function setNow(i){\n      if (i === curIdx) { return; }\n      Array.prototype.forEach.call(scope.querySelectorAll('.msq-now'), function(el){ el.classList.remove('msq-now'); });\n      curIdx = i; if (0 > i) { return; }\n      var els = scope.querySelectorAll('[data-i=\"' + i + '\"]'); if (!els.length) { return; }\n      Array.prototype.forEach.call(els, function(el){ el.classList.add('msq-now'); });\n      var r = els[0].getBoundingClientRect(), now = Date.now();\n      if (!dragging && now > lastUser + 2500 && (80 > r.top || r.bottom > window.innerHeight - 140)) {\n        var reduce = window.matchMedia && window.matchMedia('(prefers-reduced-motion: reduce)').matches;\n        autoUntil = now + (reduce ? 400 : 1600);\n        els[0].scrollIntoView({ block: 'center', behavior: reduce ? 'auto' : 'smooth' });\n      }\n    }\n    function tick(){ if (!audio.paused) { setNow(idxAt(audio.currentTime)); } }\n    function userScrolled(){ lastUser = Date.now(); }\n    ['wheel', 'touchmove', 'keydown'].forEach(function(ev){ window.addEventListener(ev, userScrolled, { passive: true }); });\n    window.addEventListener('scroll', function(){ if (Date.now() > autoUntil) { userScrolled(); } }, { passive: true });\n    window.addEventListener('mousedown', function(e){ if (e.clientX >= document.documentElement.clientWidth) { dragging = true; userScrolled(); } }, { passive: true });\n    window.addEventListener('mouseup', function(){ if (dragging) { dragging = false; userScrolled(); } }, { passive: true });\n    audio.addEventListener('play', function(){ if (timer) { clearInterval(timer); } timer = setInterval(tick, 150); tick(); });\n    audio.addEventListener('pause', function(){ if (timer) { clearInterval(timer); timer = null; } });\n    scope.addEventListener('click', function(e){\n      if (e.target.closest('a, button, input, select, textarea, label, summary, .msq, .msq-tool, .msq-end, .msq-audio, .msq-bar')) { return; }\n      var sel = window.getSelection ? String(window.getSelection()) : '';\n      if (sel && sel.trim()) { return; }\n      var el = e.target.closest('[data-i]'); if (!el) { return; }\n      var i = parseInt(el.getAttribute('data-i'), 10); if (isNaN(i)) { return; }\n      if (!audio.paused && i === curIdx) { return; }\n      lastUser = Date.now();\n      audio.currentTime = starts[i];\n      var p = audio.play(); if (p && p.catch) { p.catch(function(){}); }\n      try { if (typeof gtag === 'function') { gtag('event', 'audio_chapter', { article: location.pathname, source: 'sentence', start: Math.round(starts[i]) }); } } catch (err) {}\n    });\n    audio.addEventListener('seeked', tick);\n    audio.addEventListener('ended', function(){ setNow(-1); });\n  }\n  if (document.readyState === 'loading') { document.addEventListener('DOMContentLoaded', start); } else { start(); }\n})();<\/script>\n<\/div>\n\n\n\n<p class=\"msq-hook wp-block-paragraph\">On this page: the signing path traced through Arculus&#8217;s own How It Works paper, the three strike PIN rule quoted from the vendor, the Bitcoin derivation path m\/0&#8242; that makes a restored phrase look empty in another wallet, prices read off the shop on 7 October 2026, and ten dated App Store accounts plus one documented phishing loss.<\/p>\n\n\n\n<div class=\"msq\" id=\"ms-quiz\" data-slug=\"arculus-wallet-review\" data-category=\"self custody and wallets\" data-list=\"1\">\n<style>.msq,.msq-hook,.msq-box,.msq-end,.msq-tool{--msq-accent:#1F4E79;--msq-accent-text:#FFFFFF;--msq-line:#CBD8E6;--msq-warn:#B4531A;--msq-muted:#4A5560;--msq-tint:#EEF3F8;--msq-base:#FFFFFF}\n.msq{margin:1.25em 0 1.75em}\n.msq-hook{border-left:3px solid var(--msq-accent);padding:6px 14px;color:var(--msq-muted);font-size:.97em}\n.msq-box{background:var(--msq-tint);border:1px solid var(--msq-line);border-radius:12px;padding:0}\n.msq-box>summary{cursor:pointer;list-style:none;padding:14px 18px;font-weight:700;color:var(--msq-accent)}\n.msq-box>summary::-webkit-details-marker{display:none}\n.msq-box>summary::before{content:\"+\";display:inline-block;width:1.1em;font-weight:800}\n.msq-box[open]>summary::before{content:\"\\00d7\"}\n.msq-body{padding:2px 18px 18px}\n.msq-intro{margin:0 0 12px;font-size:.95em;color:var(--msq-muted)}\n.msq-list{margin:0;padding:0;list-style:none}\n.msq-q{margin:0 0 18px;padding:0}\n.msq-question{font-weight:700;margin:0 0 8px}\n.msq-options{display:flex;flex-direction:column;gap:8px}\n.msq-opt{text-align:left;background:var(--msq-base);border:1px solid var(--msq-line);border-radius:8px;padding:10px 12px;font:inherit;font-size:.95em;color:inherit;cursor:pointer;line-height:1.35}\n.msq-opt:hover{border-color:var(--msq-accent)}\n.msq-opt[disabled]{cursor:default}\n.msq-opt.is-right{border-color:var(--msq-accent);background:var(--msq-line);font-weight:700}\n.msq-opt.is-wrong{border-color:var(--msq-warn);color:var(--msq-warn)}\n.msq-explain{margin:8px 0 0;font-size:.92em;padding:10px 12px;border-left:3px solid var(--msq-accent);background:var(--msq-base);border-radius:0 8px 8px 0}\n.msq-explain[hidden]{display:none}\n.msq-verdict{font-weight:700}\n.msq-result{margin-top:14px;padding:14px 16px;background:var(--msq-base);border:1px solid var(--msq-line);border-radius:10px}\n.msq-result[hidden]{display:none}\n.msq-result h3{margin:0 0 6px;font-size:1.1em}\n.msq-result p{margin:0 0 8px}\n.msq-jump{margin:0 0 8px;padding-left:1.2em}\n.msq-form{margin-top:10px;display:flex;flex-wrap:wrap;gap:8px;align-items:center}\n.msq-form input[type=email]{flex:1 1 220px;padding:10px 12px;border:1px solid var(--msq-muted);border-radius:8px;font:inherit;background:#fff}\n.msq-btn{background:var(--msq-accent);color:var(--msq-accent-text);border:0;border-radius:8px;padding:11px 18px;font:inherit;font-weight:700;cursor:pointer}\n.msq-btn:hover{filter:brightness(.92)}\n.msq-btn[disabled]{opacity:.7;cursor:default}\n.msq-no{font-size:.9em;color:var(--msq-muted);margin-left:4px}\n.msq-privacy{margin:6px 0 0;font-size:.82em;color:var(--msq-muted);flex-basis:100%}\n.msq-hp{position:absolute;left:-5000px;width:1px;height:1px;overflow:hidden}\n.msq-msg{margin:8px 0 0;font-size:.92em}\n.msq-end{margin:1.5em 0;padding:18px;border:1px solid var(--msq-accent);border-radius:12px;text-align:center;background:var(--msq-tint)}\n.msq-end p{margin:0 0 12px}\n.msq-end .msq-body{text-align:left;padding:16px 0 0}\n.msq-end .msq-start-test[hidden]{display:none}\n.msq-tool{margin:1.5em 0;padding:18px 20px;background:var(--msq-tint);border:1px solid var(--msq-line);border-radius:12px}\n.msq-tool h3{margin:0 0 6px;font-size:1.15em}\n.msq-tool p{margin:0 0 10px}\n.msq-tool .msq-note{font-size:.85em;color:var(--msq-muted);margin:10px 0 0}\n.msq-check label{display:flex;gap:10px;align-items:flex-start;padding:9px 0;border-bottom:1px solid var(--msq-line);cursor:pointer;line-height:1.4}\n.msq-check label:last-of-type{border-bottom:0}\n.msq-check input{margin-top:5px;flex:0 0 auto;width:18px;height:18px;accent-color:var(--msq-accent)}\n.msq-check-count{font-weight:700;margin:10px 0 0}\n.msq-verdict-box{margin:12px 0 0;padding:10px 14px;border-radius:8px;background:var(--msq-base);border-left:3px solid var(--msq-warn)}\n.msq-verdict-box[hidden]{display:none}\n.msq-calc{display:grid;grid-template-columns:1fr 1fr;gap:10px 16px}\n.msq-calc label{display:flex;flex-direction:column;gap:4px;font-size:.92em}\n.msq-calc input,.msq-calc select{padding:8px 10px;border:1px solid var(--msq-muted);border-radius:8px;font:inherit;background:#fff}\n.msq-calc-out{grid-column:1 \/ -1;margin-top:6px;padding:12px 14px;background:var(--msq-base);border-radius:8px;border:1px solid var(--msq-line)}\n.msq-calc-out strong{font-size:1.15em}\n.msq-choose label{display:block;padding:9px 12px;margin:0 0 8px;background:var(--msq-base);border:1px solid var(--msq-line);border-radius:8px;cursor:pointer}\n.msq-choose input{margin-right:8px;accent-color:var(--msq-accent)}\n.msq-choice-result{margin-top:10px;padding:12px 14px;background:var(--msq-base);border-left:3px solid var(--msq-accent);border-radius:0 8px 8px 0}\n.msq-choice-result[hidden]{display:none}\n@media (max-width:600px){.msq-calc{grid-template-columns:1fr}}\nh2.wp-block-heading[id]{scroll-margin-top:24px}<\/style>\n<noscript><style>.msq-explain{display:block !important}<\/style><\/noscript>\n<details class=\"msq-box\">\n<summary>Think you already know this? Five questions, one minute.<\/summary>\n<div class=\"msq-body\">\n<p class=\"msq-intro\">Every answer is on this page. Answer from what you know now; the page fills in the rest.<\/p>\n<ol class=\"msq-list\">\n<li class=\"msq-q\" data-q=\"1\" data-answer=\"b\" data-title=\"What does the card show you before you approve a payment?\" data-section=\"#what-does-the-card-show-you-before-you-approve-a-payment\">\n<p class=\"msq-question\">1. Where do you read the destination address when you send from an Arculus card?<\/p>\n<div class=\"msq-options\" role=\"group\" aria-label=\"Question 1 options\"><button type=\"button\" class=\"msq-opt\" data-opt=\"a\">On a small screen built into the card<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"b\">On the phone, because the card has no display<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"c\">On the card, but only in bright light<\/button><\/div>\n<p class=\"msq-explain\" hidden><span class=\"msq-verdict\"><\/span>The component list in <a href=\"https:\/\/www.getarculus.com\/content\/Whitepapers\/Arculus-HowItWorksFinal.pdf\" target=\"_blank\" rel=\"noopener\">the Arculus How It Works paper<\/a> is steel, an NFC secure element, an antenna inlay, a PVC inlay and a polymer layer. There is no display, so the phone is the only place the transaction is shown. <a class=\"msq-section\" href=\"#what-does-the-card-show-you-before-you-approve-a-payment\">Read the section<\/a><\/p>\n<\/li>\n<li class=\"msq-q\" data-q=\"2\" data-answer=\"b\" data-title=\"What happens after three wrong PIN entries?\" data-section=\"#what-happens-after-three-wrong-pin-entries\">\n<p class=\"msq-question\">2. What does Arculus say happens after three failed PIN attempts?<\/p>\n<div class=\"msq-options\" role=\"group\" aria-label=\"Question 2 options\"><button type=\"button\" class=\"msq-opt\" data-opt=\"a\">A cooling off period of 24 hours<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"b\">The card is reset and the keys on it are wiped<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"c\">Support can unlock the card with proof of purchase<\/button><\/div>\n<p class=\"msq-explain\" hidden><span class=\"msq-verdict\"><\/span>The vendor paper says attempts are counted on the card and &#8220;after 3 failed PIN attempts, the card is reset and the keys on the card are wiped&#8221;. <a href=\"https:\/\/support.arculus.co\/hc\/en-us\/articles\/4406451357207-What-happens-if-my-Arculus-Card-gets-locked\" target=\"_blank\" rel=\"noopener\">The support article on locked cards<\/a> says the recovery phrase is then the only way back in. <a class=\"msq-section\" href=\"#what-happens-after-three-wrong-pin-entries\">Read the section<\/a><\/p>\n<\/li>\n<li class=\"msq-q\" data-q=\"3\" data-answer=\"a\" data-title=\"If the card or the phone is lost, what actually gets you back in?\" data-section=\"#if-the-card-or-the-phone-is-lost-what-actually-gets-you-back-in\">\n<p class=\"msq-question\">3. Your Arculus card is lost. What does the vendor tell you to do?<\/p>\n<div class=\"msq-options\" role=\"group\" aria-label=\"Question 3 options\"><button type=\"button\" class=\"msq-opt\" data-opt=\"a\">Buy a new card and restore from your recovery phrase, or restore in another wallet<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"b\">Send proof of ownership so Arculus can reissue your keys<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"c\">Nothing can be done, the coins are gone<\/button><\/div>\n<p class=\"msq-explain\" hidden><span class=\"msq-verdict\"><\/span><a href=\"https:\/\/support.arculus.co\/hc\/en-us\/articles\/17974845121047-What-do-I-do-if-either-my-Arculus-Card-or-my-phone-have-been-lost-or-stolen\" target=\"_blank\" rel=\"noopener\">The support page on a lost or stolen card<\/a> gives both routes. Arculus does not store anyone&#8217;s recovery phrase and cannot recover it for you. <a class=\"msq-section\" href=\"#if-the-card-or-the-phone-is-lost-what-actually-gets-you-back-in\">Read the section<\/a><\/p>\n<\/li>\n<li class=\"msq-q\" data-q=\"4\" data-answer=\"b\" data-title=\"Why can a restored Arculus phrase show no Bitcoin at all?\" data-section=\"#why-can-a-restored-arculus-phrase-show-no-bitcoin-at-all\">\n<p class=\"msq-question\">4. Which Bitcoin derivation path does Arculus say it uses?<\/p>\n<div class=\"msq-options\" role=\"group\" aria-label=\"Question 4 options\"><button type=\"button\" class=\"msq-opt\" data-opt=\"a\">The BIP44 path most wallets check first<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"b\">m\/0&#8242;, which other wallets may not look at<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"c\">A private path that only Arculus can read<\/button><\/div>\n<p class=\"msq-explain\" hidden><span class=\"msq-verdict\"><\/span><a href=\"https:\/\/support.arculus.co\/hc\/en-us\/articles\/15505522685207-Can-I-restore-the-wallet-I-created-in-Arculus-in-other-wallets\" target=\"_blank\" rel=\"noopener\">Arculus&#8217;s own page on restoring elsewhere<\/a> states that for Bitcoin it uses a derivation path of m\/0&#8242;, which &#8220;may not be supported by other wallets like Ledger, for example&#8221;, and that many wallets let you enter the path manually. <a class=\"msq-section\" href=\"#why-can-a-restored-arculus-phrase-show-no-bitcoin-at-all\">Read the section<\/a><\/p>\n<\/li>\n<li class=\"msq-q\" data-q=\"5\" data-answer=\"b\" data-title=\"Why is an Arculus firmware update always a phishing tell?\" data-section=\"#why-is-an-arculus-firmware-update-always-a-phishing-tell\">\n<p class=\"msq-question\">5. An email says your Arculus card needs a firmware patch. What is true?<\/p>\n<div class=\"msq-options\" role=\"group\" aria-label=\"Question 5 options\"><button type=\"button\" class=\"msq-opt\" data-opt=\"a\">Patch it quickly, card firmware is updated twice a year<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"b\">The card&#8217;s code cannot be updated at all, so the message is false<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"c\">Only cards bought before 2024 need the patch<\/button><\/div>\n<p class=\"msq-explain\" hidden><span class=\"msq-verdict\"><\/span>The vendor paper states the card &#8220;is shipped locked, meaning the code on the card can&#8217;t be updated&#8221;. Only the app updates. <a href=\"https:\/\/support.arculus.co\/hc\/en-us\/articles\/14525819605015-How-to-Recognize-Phishing\" target=\"_blank\" rel=\"noopener\">Arculus guidance on phishing<\/a> adds that it will never ask for your recovery phrase. <a class=\"msq-section\" href=\"#why-is-an-arculus-firmware-update-always-a-phishing-tell\">Read the section<\/a><\/p>\n<\/li>\n<\/ol>\n<div class=\"msq-result\" hidden><\/div>\n<\/div>\n<\/details>\n<script>(function(){\n  if (window.__msqInit) { return; }\n  window.__msqInit = true;\n  var root = document.getElementById('ms-quiz');\n  if (!root) { return; }\n  var meta = { slug: root.getAttribute('data-slug'), category: root.getAttribute('data-category'),\n               list: root.getAttribute('data-list') || '1' };\n  function qs(el, s){ return el.querySelector(s); }\n  function qsa(el, s){ return Array.prototype.slice.call(el.querySelectorAll(s)); }\n  function track(name, params){\n    try { if (typeof gtag === 'function') { var p = params || {}; p.article = meta.slug; gtag('event', name, p); } } catch (e) {}\n  }\n  function jumpList(missed){\n    if (!missed.length) { return ''; }\n    return '<ul class=\"msq-jump\">' + missed.map(function(q){\n      return '<li><a href=\"' + q.getAttribute('data-section') + '\">' + q.getAttribute('data-title') + '<\/a><\/li>';\n    }).join('') + '<\/ul>';\n  }\n  function emailForm(){\n    return '<div class=\"msq-sub\"><p><strong>Get the next one.<\/strong> We publish new articles on ' + meta.category\n      + ' most weeks and recheck this page on Sundays. Email me when a new article goes up or this page changes.<\/p>'\n      + '<form class=\"msq-form\" method=\"post\" action=\"\/mail\/form.php\" novalidate>'\n      + '<input type=\"hidden\" name=\"list\" value=\"' + meta.list + '\">'\n      + '<input type=\"hidden\" name=\"name\" value=\"\">'\n      + '<label class=\"msq-hp\" aria-hidden=\"true\">Leave this empty<input type=\"text\" name=\"website\" tabindex=\"-1\" autocomplete=\"off\"><\/label>'\n      + '<input type=\"email\" name=\"email\" placeholder=\"you@example.com\" required aria-label=\"Email address\" autocomplete=\"email\">'\n      + '<button type=\"submit\" class=\"msq-btn\">Email me the updates<\/button>'\n      + '<a href=\"#\" class=\"msq-no\">No thanks<\/a>'\n      + '<p class=\"msq-privacy\">We store your email and this page\\'s topic, nothing else. Unsubscribe any time.<\/p>'\n      + '<\/form><p class=\"msq-msg\" aria-live=\"polite\"><\/p><\/div>';\n  }\n  \/* The autoresponder always answers 200 with its own page. A \".msg.err\" box means the\n     address was rejected, \"You're subscribed\" means accepted, and a redirect only happens\n     after a successful subscribe. Same reading as the landing pages on the other sites. *\/\n  function sendForm(form){\n    return fetch(form.getAttribute('action'), { method: 'POST', body: new FormData(form), credentials: 'same-origin', redirect: 'manual' })\n      .then(function(res){\n        if (res.type === 'opaqueredirect') { return { status: 'ok' }; }\n        if (res.status === 404) { return { status: 'notlive' }; }\n        if (!res.ok) { throw new Error('HTTP ' + res.status); }\n        return res.text().then(function(t){\n          var doc = new DOMParser().parseFromString(t, 'text\/html');\n          var err = doc.querySelector('.msg.err');\n          if (err) {\n            var m = err.textContent.trim();\n            if (\/something went wrong\/i.test(m)) { throw new Error(m); }\n            return { status: 'rejected', message: m };\n          }\n          if (\/you.re subscribed\/i.test(doc.body.textContent)) { return { status: 'ok' }; }\n          return { status: 'unknown' };\n        });\n      });\n  }\n  function wireForm(sub){\n    var form = qs(sub, '.msq-form'), msg = qs(sub, '.msq-msg');\n    qs(form, '.msq-no').addEventListener('click', function(e){\n      e.preventDefault();\n      sub.innerHTML = '<p class=\"msq-msg\">No problem. The Sunday refresh keeps this page current either way.<\/p>';\n      track('quiz_email', { result: 'declined' });\n    });\n    form.addEventListener('submit', function(e){\n      e.preventDefault();\n      var input = qs(form, 'input[name=email]'), btn = qs(form, '.msq-btn');\n      var email = input.value.trim(); input.value = email;\n      if (!\/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$\/.test(email)) { msg.textContent = 'That email does not look right.'; return; }\n      btn.disabled = true; btn.textContent = 'Sending';\n      function reset(){ btn.disabled = false; btn.textContent = 'Email me the updates'; }\n      sendForm(form).then(function(r){\n        if (r.status === 'ok' || r.status === 'unknown') {\n          sub.innerHTML = '<p class=\"msq-msg\"><strong>Done.<\/strong> We will email you when the next article on ' + meta.category\n            + ' goes up and when this page changes. If a confirmation email arrives, click it.<\/p>';\n          track('quiz_email', { result: r.status });\n          if (r.status === 'ok') { track('generate_lead', { method: 'quiz' }); }\n        } else if (r.status === 'notlive') {\n          msg.textContent = 'Sign up is not switched on yet for this site. Nothing was stored.'; reset();\n          track('quiz_email', { result: 'notlive' });\n        } else {\n          msg.textContent = r.message || 'Please check the email address and try again.'; reset();\n          track('quiz_email', { result: 'rejected' });\n        }\n      }).catch(function(){\n        msg.textContent = 'Could not reach the sign up service just now. Nothing was stored.'; reset();\n        track('quiz_email', { result: 'error' });\n      });\n    });\n  }\n  function finish(container, mode, score, total, missed){\n    var result = qs(container, '.msq-result');\n    track('quiz_complete', { mode: mode, score: score, total: total });\n    var h;\n    if (mode === 'pre') {\n      h = '<h3>You knew ' + score + ' of ' + total + ' before reading.<\/h3>';\n      h += (score === total) ? '<p>All of them. Read on anyway; the sections below carry the detail behind each answer.<\/p>'\n                             : '<p>The rest is below. Jump straight to what you missed:<\/p>' + jumpList(missed);\n      try { sessionStorage.setItem('msq-pre-' + meta.slug, String(score)); } catch (e) {}\n    } else {\n      var pre = null;\n      try { pre = sessionStorage.getItem('msq-pre-' + meta.slug); } catch (e) {}\n      h = '<h3>You got ' + score + ' of ' + total + '.<\/h3>';\n      if (pre !== null) { h += '<p>Before reading you had ' + pre + ' of ' + total + '.<\/p>'; }\n      if (missed.length) { h += '<p>Worth a second look:<\/p>' + jumpList(missed); }\n      h += emailForm();\n    }\n    result.innerHTML = h; result.hidden = false;\n    if (mode !== 'pre') { wireForm(qs(result, '.msq-sub')); }\n    result.scrollIntoView({ behavior: 'smooth', block: 'nearest' });\n  }\n  function setup(container, mode){\n    var qEls = qsa(container, '.msq-q'), answered = 0, score = 0, missed = [];\n    qEls.forEach(function(q){\n      var answer = q.getAttribute('data-answer'), opts = qsa(q, '.msq-opt'), explain = qs(q, '.msq-explain');\n      q.removeAttribute('data-done'); explain.hidden = true; qs(explain, '.msq-verdict').textContent = '';\n      opts.forEach(function(b){ b.disabled = false; b.classList.remove('is-right', 'is-wrong'); });\n      opts.forEach(function(b){\n        b.addEventListener('click', function(){\n          if (q.getAttribute('data-done')) { return; }\n          q.setAttribute('data-done', '1');\n          var ok = b.getAttribute('data-opt') === answer;\n          opts.forEach(function(o){ o.disabled = true; if (o.getAttribute('data-opt') === answer) { o.classList.add('is-right'); } });\n          if (ok) { score += 1; } else { b.classList.add('is-wrong'); missed.push(q); }\n          qs(explain, '.msq-verdict').textContent = ok ? 'Right. ' : 'Not quite. ';\n          explain.hidden = false;\n          answered += 1;\n          track('quiz_answer', { mode: mode, question: q.getAttribute('data-q'), correct: ok ? 1 : 0 });\n          if (answered === qEls.length) { finish(container, mode, score, qEls.length, missed); }\n        });\n      });\n    });\n  }\n  var box = qs(root, '.msq-box');\n  setup(root, 'pre');\n  if (box) { var skipFirst = box.hasAttribute('data-default-open'); box.addEventListener('toggle', function(){ if (!box.open) { return; } if (skipFirst) { skipFirst = false; return; } track('quiz_open', { mode: 'pre' }); }); }\n  \/* The end block sits far below this script, so it does not exist yet while this runs\n     during parsing. A delegated listener finds it at click time. *\/\n  document.addEventListener('click', function(e){\n    var startBtn = (e.target && e.target.closest) ? e.target.closest('.msq-start-test') : null;\n    if (!startBtn) { return; }\n    var end = startBtn.closest('.msq-end');\n    if (!end) { return; }\n    var mount = qs(end, '.msq-mount');\n    var clone = qs(root, '.msq-body').cloneNode(true);\n    var intro = qs(clone, '.msq-intro');\n    if (intro) { intro.textContent = 'The same five questions, now that you have read the page.'; }\n    var res = qs(clone, '.msq-result'); if (res) { res.hidden = true; res.innerHTML = ''; }\n    mount.innerHTML = ''; mount.appendChild(clone);\n    setup(mount, 'test');\n    startBtn.hidden = true;\n    track('quiz_open', { mode: 'test' });\n    mount.scrollIntoView({ behavior: 'smooth', block: 'start' });\n    var first = qs(mount, '.msq-opt'); if (first) { first.focus({ preventScroll: true }); }\n  });\n  \/* Shared tool behaviour: checklists remember their ticks on this device, and a chooser\n     shows the result for the option picked. Calculators carry their own small script. *\/\n  function initTools(){\n    qsa(document, '.msq-check').forEach(function(box){\n      var key = 'msq-check-' + meta.slug + '-' + (box.getAttribute('data-id') || 'x');\n      var boxes = qsa(box, 'input[type=checkbox]'), count = qs(box, '.msq-check-count');\n      var yes = qs(box, '.msq-verdict-yes'), no = qs(box, '.msq-verdict-no');\n      var saved = {};\n      try { saved = JSON.parse(localStorage.getItem(key) || '{}'); } catch (e) {}\n      boxes.forEach(function(cb, i){ if (saved[i]) { cb.checked = true; } });\n      function refresh(){\n        var n = boxes.filter(function(cb){ return cb.checked; }).length, state = {};\n        boxes.forEach(function(cb, i){ if (cb.checked) { state[i] = 1; } });\n        try { localStorage.setItem(key, JSON.stringify(state)); } catch (e) {}\n        if (count) { count.textContent = n + ' of ' + boxes.length + (box.getAttribute('data-verb') || ' done'); }\n        if (yes && no) { yes.hidden = n === 0; no.hidden = n !== 0; }\n      }\n      boxes.forEach(function(cb){ cb.addEventListener('change', function(){ refresh(); track('tool_check', { tool: box.getAttribute('data-id') }); }); });\n      refresh();\n    });\n    qsa(document, '.msq-choose').forEach(function(box){\n      var results = qsa(box, '.msq-choice-result');\n      qsa(box, 'input[type=radio]').forEach(function(r){\n        r.addEventListener('change', function(){\n          results.forEach(function(el){ el.hidden = el.getAttribute('data-for') !== r.value; });\n          track('tool_choose', { tool: box.getAttribute('data-id'), choice: r.value });\n        });\n      });\n    });\n  }\n  \/\/ read progress: how far down the article the reader has scrolled, fired once per quarter\n  (function(){\n    var art = root.closest('article') || root.parentNode, fired = {};\n    function check(){\n      var top = art.getBoundingClientRect().top + window.pageYOffset, h = art.offsetHeight || 1;\n      var seen = (window.pageYOffset + window.innerHeight - top) \/ h * 100;\n      [25, 50, 75, 100].forEach(function(m){ if (seen >= m && !fired[m]) { fired[m] = true; track('read_progress', { percent: m }); } });\n    }\n    window.addEventListener('scroll', check, { passive: true }); window.addEventListener('load', check);\n  })();\n  if (document.readyState === 'loading') { document.addEventListener('DOMContentLoaded', initTools); } else { initTools(); }\n})();<\/script>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"how-does-the-arculus-wallet-actually-sign-a-transaction\">How does the Arculus wallet actually sign a transaction?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Arculus is two things that only work together: a stainless steel card from Arculus Holdings, the metal card maker CompoSecure&#8217;s crypto arm, and a phone app. Keys are generated on the card with a true random number generator inside what <a href=\"https:\/\/www.getarculus.com\/content\/Whitepapers\/Arculus-HowItWorksFinal.pdf\" target=\"_blank\" rel=\"noopener\">the vendor&#8217;s own How It Works paper<\/a> calls a CC EAL6 plus secure element. The paper is blunt about the division of labour: &#8220;Your private keys never leave the Secure Element on the Arculus Card, and the card is necessary for signing all transactions.&#8221;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The app holds your account public keys and nothing more. To send coins you enter the six digit PIN that is stored on the card rather than on the phone, then hold the card to the back of the handset. The card checks the PIN, signs, and the app broadcasts. Arculus calls this three factor authentication: something you are, a face or fingerprint; something you know, the PIN; something you have, the card.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Two details in that paper matter more than the marketing around them. The radio is near field communication with, in the vendor&#8217;s words, &#8220;a range of only a few centimeters unlike Bluetooth which has a range of 10 meters&#8221;. And the card ships locked, so &#8220;the code on the card can&#8217;t be updated&#8221;. Hold on to that second one. It decides the whole phishing section below, and it is the same trade off as in <a href=\"https:\/\/getbitcoin.guide\/articles\/tangem-crypto-wallet\/\">the Tangem card review<\/a>, where no updates also means no fixes.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-does-the-card-show-you-before-you-approve-a-payment\">What does the card show you before you approve a payment?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Nothing. There is no display. The components the vendor lists are treated stainless steel, an NFC enabled secure element, an antenna inlay, a PVC inlay and a protective polymer layer. No screen appears in that list because there is no screen in the card.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That matters more than the affiliate reviews let on. On a device with a display, the address and the amount appear on the hardware itself, which is the one link in the chain that malware on your laptop or phone cannot repaint. With Arculus the only place you ever read the destination address is the phone screen, and the card signs whatever the app hands it. The security of the tap is excellent. The security of what you are tapping to approve is the security of your phone. To be fair to the vendor, this is a published design choice and not a reported flaw: searching on 7 October 2026 we found no CVE and no security advisory describing a break of the card itself.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Device<\/th><th>What the device itself shows you<\/th><th>Wrong PINs before it wipes<\/th><th>Card or firmware updatable<\/th><\/tr><\/thead><tbody><tr><td>Arculus Key Card<\/td><td>Nothing, there is no display<\/td><td>3, per <a href=\"https:\/\/www.getarculus.com\/content\/Whitepapers\/Arculus-HowItWorksFinal.pdf\" target=\"_blank\" rel=\"noopener\">the How It Works paper<\/a><\/td><td>No, shipped locked by design<\/td><\/tr><tr><td>Ledger Nano S Plus<\/td><td>1.1 inch monochrome OLED, <a href=\"https:\/\/shop.ledger.com\/products\/ledger-nano-s-plus\" target=\"_blank\" rel=\"noopener\">128 by 64 pixels<\/a><\/td><td>3, <a href=\"https:\/\/support.ledger.com\/article\/Why-Your-Ledger-Device-Is-Secure\" target=\"_blank\" rel=\"noopener\">Ledger resets to factory settings<\/a><\/td><td>Yes, firmware updates<\/td><\/tr><tr><td>Trezor Safe 5<\/td><td>1.54 inch colour touchscreen, <a href=\"https:\/\/trezor.io\/trezor-safe-5\" target=\"_blank\" rel=\"noopener\">240 by 240 pixels<\/a><\/td><td>16, with <a href=\"https:\/\/trezor.io\/guides\/trezor-devices\/trezor-fundamentals\/pin-protection-on-trezor-devices\" target=\"_blank\" rel=\"noopener\">a doubling delay each time<\/a><\/td><td>Yes, firmware updates<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Read the second column and the fourth together and you have the honest summary of this card. You give up on device verification and you give up the ability to patch, and in exchange you get something that fits in a wallet, never needs charging and has no port to break. The longer version of that argument is in <a href=\"https:\/\/getbitcoin.guide\/articles\/what-is-a-cold-wallet\/\">what a cold wallet actually is<\/a>.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1600\" height=\"900\" src=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/arculus-wallet-review-chart.png\" alt=\"Bar chart showing the arculus wallet card has no screen against Ledger and Trezor displays.\" class=\"wp-image-469\" srcset=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/arculus-wallet-review-chart.png 1600w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/arculus-wallet-review-chart-300x169.png 300w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/arculus-wallet-review-chart-1024x576.png 1024w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/arculus-wallet-review-chart-768x432.png 768w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/arculus-wallet-review-chart-1536x864.png 1536w\" sizes=\"auto, (max-width: 1600px) 100vw, 1600px\" \/><figcaption class=\"wp-block-image__caption\">More pixels is not more security. Zero is the point: every check happens on your phone instead.<\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-happens-after-three-wrong-pin-entries\">What happens after three wrong PIN entries?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The card locks and wipes. The vendor paper states that PIN attempts are counted on the card and &#8220;after 3 failed PIN attempts, the card is reset and the keys on the card are wiped to protect against brute force attacks&#8221;. The <a href=\"https:\/\/support.arculus.co\/hc\/en-us\/articles\/4406451357207-What-happens-if-my-Arculus-Card-gets-locked\" target=\"_blank\" rel=\"noopener\">support article on locked cards<\/a> says the same thing from the user side: the only way a card locks is three wrong PINs in a row while trying to send, and after that the recovery phrase is the only way back in.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1376\" height=\"768\" src=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/failed-pin-attempt-on-arculus-wallet.jpg\" alt=\"A sleek metal card sits beside a phone screen after a failed login with the arculus wallet.\" class=\"wp-image-465\" srcset=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/failed-pin-attempt-on-arculus-wallet.jpg 1376w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/failed-pin-attempt-on-arculus-wallet-300x167.jpg 300w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/failed-pin-attempt-on-arculus-wallet-1024x572.jpg 1024w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/failed-pin-attempt-on-arculus-wallet-768x429.jpg 768w\" sizes=\"auto, (max-width: 1376px) 100vw, 1376px\" \/><figcaption class=\"wp-block-image__caption\">Entering three incorrect PINs will wipe the security card for safety.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Three strikes is the same budget Ledger gives you. The difference is how often you type the thing. A six digit PIN you last used four months ago, entered while holding a card flat against the back of a phone, with the app warning you this is the last attempt, is a worse position than the number suggests. Trezor&#8217;s sixteen attempts with doubling delays are not more secure in theory. They are simply kinder to a human memory.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Nothing is lost if your recovery phrase is good, and everything is lost if it is not. Arculus shows the 12 or 24 word phrase exactly once during setup, makes you type it back, and then, in the paper&#8217;s words, &#8220;the app will never show your recovery phrase again&#8221;. It is kept on neither the card nor the phone.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"if-the-card-or-the-phone-is-lost-what-actually-gets-you-back-in\">If the card or the phone is lost, what actually gets you back in?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The recovery phrase, in every branch. The <a href=\"https:\/\/support.arculus.co\/hc\/en-us\/articles\/17974845121047-What-do-I-do-if-either-my-Arculus-Card-or-my-phone-have-been-lost-or-stolen\" target=\"_blank\" rel=\"noopener\">support page on a lost or stolen card<\/a> tells you to buy a new Arculus card and restore from the phrase, or to restore in a third party wallet app instead if you would rather not replace the card. The <a href=\"https:\/\/support.arculus.co\/hc\/en-us\/articles\/1500012919402-How-do-I-restore-my-Arculus-Wallet-to-a-new-phone-or-a-new-card\" target=\"_blank\" rel=\"noopener\">restore instructions<\/a> describe one flow for a new phone and for a new card alike, and it ends with typing the words in. So plan on needing them even in the cases where the card survives.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Two practical notes the review sites skip. The app supports <a href=\"https:\/\/support.arculus.co\/hc\/en-us\/articles\/22249912358679-How-do-I-Set-up-and-Manage-Multiple-Cards-in-my-Arculus-Wallet-app\" target=\"_blank\" rel=\"noopener\">more than one card on the same wallet<\/a>, which is why the vendor sells <a href=\"https:\/\/www.getarculus.com\/bundle\" target=\"_blank\" rel=\"noopener\">a two card bundle<\/a>, listed at 76.26 dollars against 59.76 dollars for a single card when we read the shop on 7 October 2026, both discounted from a 99 dollar list price. A spare card does not replace a written phrase. It does remove the week you would otherwise spend waiting for the post while locked out.<\/p>\n\n\n\n<div class=\"msq-tool msq-check\" data-id=\"arculus-recovery-checklist\" data-verb=\" done\">\n<h3>Card lost, or phone lost: the order the vendor documents<\/h3>\n<p>This restates what Arculus publishes about its own recovery process. It asks for nothing, stores nothing, and will never want your recovery words. Neither will anyone else who is telling the truth.<\/p>\n<label><input type=\"checkbox\">Stop before you type anything. No support agent, website, form or app needs your recovery phrase, ever.<\/label>\n<label><input type=\"checkbox\">Search for the card properly first. A replacement is an order and a wait, not an emergency.<\/label>\n<label><input type=\"checkbox\">Check you can still read your 12 or 24 words from wherever you wrote them, without typing them anywhere.<\/label>\n<label><input type=\"checkbox\">Write the Bitcoin derivation path m\/0&#8242; on the same page as the words, because another wallet may show zero without it.<\/label>\n<label><input type=\"checkbox\">Card gone: order a replacement card, or restore in a wallet that lets you set the derivation path yourself.<\/label>\n<label><input type=\"checkbox\">Phone gone: install the app on the new handset and follow the vendor restore flow, which ends by asking for the phrase.<\/label>\n<label><input type=\"checkbox\">Choose a six digit PIN you will still know in six months. Three wrong tries while sending wipes the card.<\/label>\n<label><input type=\"checkbox\">If anyone may have seen your words, treat that wallet as spent and move the coins to a new one.<\/label>\n<label><input type=\"checkbox\">If you keep a spare card on the same wallet, store it somewhere the first card is not.<\/label>\n<p class=\"msq-check-count\"><\/p>\n<p class=\"msq-note\">Ticks are saved on this device only. Information about a published process, not financial advice.<\/p>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"why-can-a-restored-arculus-phrase-show-no-bitcoin-at-all\">Why can a restored Arculus phrase show no Bitcoin at all?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This is the most useful thing on this page, and we found it in none of the reviews ranking for this wallet. A recovery phrase does not contain your addresses. It contains a seed, and wallet software derives addresses from that seed by walking a numbered route called a derivation path. Two wallets with the same words and different paths show two different sets of addresses, and one of them will look empty.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Arculus is explicit about this in its own documentation. Its <a href=\"https:\/\/support.arculus.co\/hc\/en-us\/articles\/15505522685207-Can-I-restore-the-wallet-I-created-in-Arculus-in-other-wallets\" target=\"_blank\" rel=\"noopener\">page on restoring an Arculus wallet elsewhere<\/a> states that for Bitcoin, Arculus uses a derivation path of m\/0&#8242;, said aloud as m slash zero hardened, and that this &#8220;may not be supported by other wallets like Ledger, for example&#8221;. Most wallets reach for the BIP44 style paths instead. The vendor adds that many wallets will let you enter m\/0&#8242; manually to find the coins.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1376\" height=\"768\" src=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/restoring-arculus-wallet-with-recovery-phrase.jpg\" alt=\"A man holding a recovery card looks at his laptop while restoring his arculus wallet.\" class=\"wp-image-466\" srcset=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/restoring-arculus-wallet-with-recovery-phrase.jpg 1376w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/restoring-arculus-wallet-with-recovery-phrase-300x167.jpg 300w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/restoring-arculus-wallet-with-recovery-phrase-1024x572.jpg 1024w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/restoring-arculus-wallet-with-recovery-phrase-768x429.jpg 768w\" sizes=\"auto, (max-width: 1376px) 100vw, 1376px\" \/><figcaption class=\"wp-block-image__caption\">Derivation paths can affect how balances appear when restoring a backup.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Picture the bad evening. The card is gone, you type twelve correct words into a different wallet, and the balance reads zero. Nothing has moved. The new wallet is looking down a different corridor. People in that position search for the wrong thing, meet a helpful stranger, and lose the coins for real. So write the path down beside the words, in plain language: Bitcoin on m\/0&#8242;, from an Arculus card. Version 3.12.0 of the app, released on 11 June, also added address export, which lets you record your own receiving addresses while everything still works.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Nobody should ever type a recovery phrase into a website, a support chat, a form or an app that was sent to them. There is no legitimate situation in which that is the fix.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"why-is-an-arculus-firmware-update-always-a-phishing-tell\">Why is an Arculus firmware update always a phishing tell?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Because there is no such thing. The card ships locked and its code cannot be updated, which the vendor presents as a security feature: nothing can introduce hacked or infected code onto it. Follow that to its conclusion and you have a rule that needs no technical knowledge at all. Any message telling you to update, patch or revalidate your Arculus card is false, whatever the sender address says. The app updates. The card does not, ever.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The app genuinely does update, which is where the confusion gets harvested. <a href=\"https:\/\/apps.apple.com\/us\/app\/arculus-wallet\/id1575425801\" target=\"_blank\" rel=\"noopener\">The App Store listing<\/a> showed version 3.12.2 published on 11 August, rated 4.6 out of 5 across about 1,300 ratings, and requiring iOS 17.5 or later, when we checked it on 7 October 2026. Those updates arrive through the App Store or Google Play and never through an email.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The attacks are real and documented. A complaint published on <a href=\"https:\/\/scamcrypto.net\/topic\/sophisticated-phishing-scam-targeting-arculus-wallet-users-via-arculus-at\/\" target=\"_blank\" rel=\"noopener\">ScamCrypto on 25 November 2024<\/a> describes a personalised email with the subject line &#8220;Private Invitation&#8221; that led to a look alike site at arculus.at, where the holder entered a 12 word recovery phrase; the report puts the loss at 102,818 dollars, moved out through several exchanges. That is one person&#8217;s report on a complaint board rather than a regulator&#8217;s finding, so treat the figure as claimed. The method is not in doubt. Arculus&#8217;s own <a href=\"https:\/\/support.arculus.co\/hc\/en-us\/articles\/14525819605015-How-to-Recognize-Phishing\" target=\"_blank\" rel=\"noopener\">guidance on recognising phishing<\/a> states plainly that it will never ask for your recovery phrase.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-do-people-who-use-arculus-actually-report\">What do people who use Arculus actually report?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">We read the ten reviews shown on <a href=\"https:\/\/apps.apple.com\/us\/app\/arculus-wallet\/id1575425801?see-all=reviews&#038;platform=iphone\" target=\"_blank\" rel=\"noopener\">the App Store review page<\/a> on 7 October 2026, against an overall 4.6 out of 5 from roughly 1,300 ratings, plus the public complaint above. The balance is mostly positive, so treat what follows as the shape of the complaints rather than the shape of the product.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>A one star review dated 13 July 2024 reports restoring with what the reviewer says was the correct phrase, and a balance that showed nothing.<\/li><li>A two star review dated 4 September 2024 reports three replacement cards, repeated tap dropouts and balances loading inconsistently.<\/li><li>Two reviews, from 15 January 2023 and 9 November 2021, report a balance briefly reading zero after a reinstall before correcting itself.<\/li><li>A five star review dated 15 March 2024 credits support with clearing a cross network token problem that had sat unresolved for two years.<\/li><li>A January 2023 review calls the in app fees high, which is a swap complaint rather than a custody one.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Those are accounts, not measurements, and two of them are old enough that the app has been rewritten several times since. The pattern that holds up is the tap: the vendor keeps <a href=\"https:\/\/support.arculus.co\/hc\/en-us\/articles\/6218826179607-Why-am-I-receiving-a-connection-error-message-after-entering-my-PIN-code-when-trying-to-send-my-crypto\" target=\"_blank\" rel=\"noopener\">a dedicated help page<\/a> for the card connection error, which it puts down to the card not being aligned with the phone&#8217;s NFC antenna. That matches the reviews almost exactly, and differs from the official story in tone rather than in substance.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Where the accounts and the documentation genuinely part company is the empty balance. Support frames a zero reading as a display problem. The derivation path page shows that a zero reading after restoring somewhere else is the expected result, not a glitch. One claim we could not check at all: a review aggregator asserts that Arculus user emails were exposed, and we found no vendor advisory, regulator filing or news report behind it, so we are not repeating it as fact. For a customer data leak that is documented, at a different vendor, see <a href=\"https:\/\/getbitcoin.guide\/articles\/safepal-wallet-review\/\">the SafePal review<\/a>. Arculus also carries other chains and in app features including swaps and staking, <a href=\"https:\/\/support.arculus.co\/hc\/en-us\/articles\/4407090079127-Which-cryptocurrencies-am-I-able-to-swap-send-receive-in-the-Arculus-Wallet\" target=\"_blank\" rel=\"noopener\">listed on its support site<\/a>; this site covers custody and security only and takes no view on any of them, and <a href=\"https:\/\/getbitcoin.guide\/articles\/zengo-crypto-wallet\/\">the Zengo write up<\/a> covers a different answer to the same question.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"frequently-asked-questions\">Frequently asked questions<\/h2>\n\n\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list \">\n<div id=\"faq-q-1\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Does the Arculus wallet work with an iPhone?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Yes. The Arculus Wallet app on the App Store required iOS 17.5 or later when we checked on 7 October 2026, and signing is done by holding the card against the back of the handset so the phone can read it over NFC. An Android app is published separately.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-2\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Is the Arculus card air gapped?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Not in the strict sense. There are no cables, no USB port and no battery, but the card talks to the phone over near field communication, which the vendor says reaches only a few centimetres. Tap to sign is a fair description. Fully air gapped is not.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-3\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">How much does the Arculus wallet cost?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Reading the vendor&#8217;s own shop on 7 October 2026, a single card was listed at 59.76 dollars against a 99 dollar list price, and a two card bundle at 76.26 dollars against 198 dollars. Prices on promotion move, so check the shop rather than a review.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-4\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Can you use two Arculus cards with one wallet?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Yes. The support site documents setting up and managing multiple cards in the app, which is the point of the two card bundle. A second card shortens a lockout, but it does not replace a written recovery phrase kept somewhere else.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-5\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">What happens to your coins if Arculus stops operating?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>The recovery phrase is generated to the BIP39 standard, so it can be restored in other wallet software. For Bitcoin you will need a wallet that lets you enter the m\/0&#8242; derivation path, because that is the route Arculus uses and most wallets do not look there first.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-6\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Does Arculus hold your keys or do you?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>You do. The vendor states the private keys are generated inside the secure element on the card and never leave it, that the app only ever sees account public keys, and that Arculus does not store any customer&#8217;s recovery phrase and cannot recover it for you.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n<div class=\"msq-end\" id=\"ms-quiz-end\">\n<p><strong>Finished the page?<\/strong> The same five questions from the top, to see what stuck.<\/p>\n<button type=\"button\" class=\"msq-btn msq-start-test\">Test Your Understanding of This Article<\/button>\n<div class=\"msq-mount\"><\/div>\n<\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><em>This article is educational and is not financial advice. Nothing here is a recommendation to buy, sell or hold anything. You are responsible for your own security decisions.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>What the Arculus card does and does not show you before it signs, what three wrong PINs cost, and why a restored Arculus phrase can show no Bitcoin in another wallet.<\/p>\n","protected":false},"author":1,"featured_media":464,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","rank_math_title":"Arculus Wallet: Three Wrong PINs and One Odd Seed Path","rank_math_description":"The Arculus wallet signs with a tap and a six digit PIN. It has no screen, three wrong PINs wipe the card, and its Bitcoin path is not the usual one.","rank_math_focus_keyword":"arculus wallet","rank_math_canonical_url":"","rank_math_breadcrumb_title":"","rank_math_facebook_title":"","rank_math_facebook_description":"","rank_math_facebook_image":"","rank_math_twitter_title":"","rank_math_twitter_description":"","rank_math_twitter_image":"","rank_math_pillar_content":"","rank_math_robots":[],"rank_math_advanced_robots":[]},"categories":[2],"tags":[],"class_list":["post-467","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-wallets"],"_links":{"self":[{"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/posts\/467","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/comments?post=467"}],"version-history":[{"count":4,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/posts\/467\/revisions"}],"predecessor-version":[{"id":473,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/posts\/467\/revisions\/473"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/media\/464"}],"wp:attachment":[{"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/media?parent=467"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/categories?post=467"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/tags?post=467"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}