Vexl

Imagine you want to buy bitcoin from someone nearby. You find an offer in Vexl and agree on a price and payment method in the chat. You now have an agreement, but no payment has happened yet: the seller still has to send bitcoin from their wallet, and the buyer has to pay as agreed. Vexl does not provide escrow, an arrangement that holds funds until the conditions of a trade are met. Its terms also say it cannot confirm whether a trade occurred. If you need a receipt, arrange that with the other participant. [1] [2]

You can make an offer visible to your direct contacts or also to their contacts. For example, you know Anna, and Anna knows a seller you have never met. The app shows the shared connection without immediately revealing who posted the offer. A project explanation from May 2026 says the mutual contact need not use Vexl themselves. This network can give an offer some familiar context. It does not prove that the seller has the promised funds or will honour the agreement; the person and the terms still matter. [3]

Registration requires a valid phone number, which Vexl verifies with a code. It also creates a private account key on your phone: a cryptographic credential the app uses to establish your access. This is not automatically the key controlling bitcoin in your separate wallet. Think of access to a messaging app and access to the wallet you pay from as separate things. Losing access to Vexl does not by itself tell you whether the wallet can be recovered. If both apps were on a lost phone, each needs attention according to its own backup and security arrangements. [1] [2]

Vexl’s technical description places profiles, contact lists, offers and chats in separate server services. The connections between them are meant to come together on your phone. The aim is to limit a server’s ability to assemble a complete picture of who is dealing with whom. The project describes hashing contacts, producing computed fingerprints for comparison, as well as encrypting messages to protect their contents. These are different mechanisms. Explaining the design tells you how protection is intended to work; it is not an independent security assessment or a promise that the entire trade is anonymous. [3]

Rejoining a network of people and restoring an old conversation are different tasks. The FAQ says you can register again after losing your phone and import your contacts again. It also says the account cannot be backed up. Under the terms, losing the local key means the original account and its data cannot be recovered. Starting again therefore does not restore old offers or messages. Important trade records should not live only in this chat; backing up your bitcoin wallet is a separate responsibility. [1] [2]

The FAQ says Vexl is free to use, but whoever creates an offer can set a fee. That fee belongs to the trade’s terms; it is not automatically a bitcoin network fee. Before agreeing, establish the total you will pay and how much bitcoin you will receive. An offer can specify an on-chain transfer, directly on Bitcoin’s base network, or Lightning, a payment network using payment channels. Your wallet and payment details must support the chosen method. Vexl helps you agree on these details; it does not carry out the transfer. [2]

Encryption protects a conversation’s contents, but messages also have surrounding information. The FAQ describes temporary storage of encrypted messages and acknowledges that the server may see your IP address, the network address of your connection. Phone notifications use Firebase Cloud Messaging. Apple or Google may also collect information such as app usage through the operating system. These are metadata: information about activity rather than necessarily the message text. And if you voluntarily reveal your identity to the other person, you cannot make them forget it afterwards. [1] [2]

Vexl publishes its source code and instructions for checking an Android APK, an app installation package. When installing from such a file, you can follow those instructions to compare the signing certificate’s fingerprint with the project’s published value. The check helps establish whether the package came from the expected publisher; the documentation advises against installing it if they differ. A match does not guarantee bug-free software, nor does it establish the honesty of someone whose offer you later open. App origin, phone security and the trustworthiness of a trade require separate consideration. [4]