New Release: ZEUS v13.2.0
v13.2.0 is about depth: more flexibility, fresher node software, better ecash compatibility, more privacy controls, and one of the largest security hardening efforts we've ever shipped
Today we're releasing ZEUS v13.2.0, now available on Google Play, the Apple App Store, and as a direct APK download.
Where v13.0.0 introduced the graduated wallet experience and our new LDK Node engine, v13.2.0 is about depth: more flexibility for self-custodial users, fresher node software, better ecash compatibility, more privacy controls, and one of the largest security hardening efforts we've ever shipped in a single release.
Here's what's new.
24-word seed phrases for LDK Node wallets
LDK Node wallets can now be created with either 12 or 24-word seed phrases. When creating a new wallet, you'll find the seed length option under advanced settings (12 words remains the default). When restoring, a new recovery options screen lets you pick the seed length before you start typing.
We've also made sure the rest of the wallet plays nicely with 24-word seeds: Cashu wallet keys are derived correctly for 24-word wallets, and swap rescue keys are generated independently rather than reusing the node seed.
Embedded LND v0.21.2-beta
The embedded LND node engine has been upgraded to our build of LND v0.21.2-beta. The v0.21 series migrates LND's payment store from key-value storage to native SQL, and v0.21.2 stabilizes the series with fixes for database migration issues that could prevent nodes from starting up. Embedded wallets get these improvements automatically, with no action required.
Cashu upgrade: Minibits compatibility
We've upgraded the Cashu Dev Kit (CDK) that powers ZEUS's ecash features from v0.14.2 to v0.17.4. Mints across the ecosystem, including the popular Minibits mint, have been upgrading to newer mint software that older CDK versions could not communicate with, which resulted in errors when creating invoices. ZEUS is now compatible with these mints and better positioned to keep pace as more mints upgrade.
The new CDK also comes with a batch of reliability fixes we contributed upstream, along with improvements on our side: clearer error messages, mint removal that sticks across restarts, and more robust multi-mint balance handling.
Privacy: custom Mempool instances
You can now point ZEUS at your own Mempool instance. Set a custom URL under Settings > Privacy and ZEUS will use it for fee estimation, block height lookups, and private key sweeps, instead of sending those requests to mempool.space. If you self-host Mempool, none of that traffic needs to leave your infrastructure. Custom block explorer and Mempool URLs are validated before they're saved.
Security hardening
This release includes dozens of security fixes from an ongoing internal review of the app. Highlights:
- Complete data wipes. Duress PIN and failed-attempt lockout wipes now remove all wallet data, including ecash databases, node data directories, and cached key material, and the app reliably restarts even if part of the wipe fails. Wallet deletion now purges all key material associated with the wallet.
- Nostr Wallet Connect hardening. Connection expiry is now enforced across all methods, spending budgets account for routing and melt fees, invoice and transaction lookups are scoped to each connection's own activity, invoice creation is rate-limited per connection, and client keys are rotated when a connection's relay is changed.
- Payment safety. ZEUS now blocks payment of expired invoices, verifies LNURL invoices before paying, and guards against double-submission of payments.
- Network egress. Clipboard checks no longer touch the network, viewing a Cashu token from an untrusted mint no longer contacts that mint, and BIP353 lightning address resolution now enforces DNSSEC validation.
- Supply chain. All pre-built native libraries fetched during our build process are now verified against pinned SHA-256 hashes.
- Logging. Sensitive payment and credential material has been scrubbed from app logs.
This hardening effort follows the infrastructure incident we disclosed earlier this month, and reflects the same principle: assume breach, always move forward. We've also published a security policy with our vulnerability disclosure process. If you find something, we want to hear from you.
Special thanks to the Bitcoin Red Team and the other independent researchers who responsibly disclosed their findings over the past few weeks.
Additional improvements
- Swaps get a number of reliability fixes in this release, including BIP39 checksum enforcement on rescue key restores. With Boltz swaps currently suspended, we've also limited swap service calls to only occur on the Swaps view, instead of probing for rates in advance. As a reminder, ZEUS Swaps are indefinitely suspended, but users can still initiate fund rescues manually on our swaps website.
- LDK Node wallet restores now fail loudly if the remote backup (VSS) server is unreachable, instead of silently building an empty wallet
- Core Lightning: payments migrated to xpay, with support for fixed fee limits in sats
- LSP: real error messages from the LSP are now surfaced when a wrapped invoice is rejected, instead of silently falling back to an invoice you may not be able to receive on
- Streamlined ZEUS Pay onboarding and fixed stale authentication when switching nodes
- UI polish: clearer disabled states on payment buttons, better placeholder contrast across themes, smoother pull-to-refresh, and refresh progress in the wallet balance list
- Updated translations, courtesy of our community translators
Get started
Download ZEUS for your platform:
Android builds are reproducible and releases are PGP-signed. Verification instructions are available in the repo.
Thank you to everyone who tested the release candidates, filed issues, reviewed code, and contributed translations. ZEUS is free and open source software, built in the open under the AGPLv3 license. If you'd like to support development, check out ZEUS Pay+ (under Menu > Lightning address in the app) or donate.
Onward.
The ZEUS Team
