Security

Prysm never stores your private key. You own your wallet. Only you can export your key.

Send /trade in your DM with Prysm and tap Wallet. Export there takes you to your key, and Security shows whether you have a PIN and who can send you USDC.

You own your wallet

Your Solana and EVM wallets are created by our wallet provider the first time you use your wallet, and they belong to you. Prysm is only an added signer, with two limited permissions:

trading: buying and selling for you, and nothing else;
withdrawals to the address you choose, within the daily limit.

Prysm can’t export your key and can’t change who owns the wallet or who may sign for it.

Keep your Telegram account safe

Your Prysm wallet is tied to your Telegram account. Keeping that account safe is your responsibility. Anyone who gets into your Telegram account can trade, withdraw and export your key. A PIN, if you set one, protects withdrawals.

Turn on Telegram’s two-step verification (Telegram → Settings → Privacy and Security → Two-Step Verification). It’s the single best protection you have.

If you lose your Telegram account, you also lose the way to export your key (below). There is no other way to sign in to your wallet yet.

Export your private key

You can take your key and use the wallet in any other wallet app.

Tap Export on your wallet. Switch between Solana and EVM at the top.
A small Prysm page opens inside Telegram, signs you in with your Telegram account and opens our wallet provider’s secure window with the key. If it shows a Show my … key button instead, tap it.
Save the key somewhere safe and offline. Closing the window takes you back to the chat.

Once you have your key, you can move your funds with it from any wallet app. That’s your money; Prysm doesn’t stop or flag it.
The key goes straight from our wallet provider to you. It never passes through Prysm, and it is never sent as a message in the chat.
There is no daily limit on exports.
The first time you export your Solana key, and the first time you export your EVM key, Prysm sends you a short message saying so. Later exports send nothing.
Export works only from your private chat with Prysm, never from a group.

Set a PIN (recommended)

If your Security screen shows a Set a PIN button, you can add a 6-digit PIN. It’s optional, but recommended. During the trading beta the PIN may not be offered yet.

When a PIN is set, it is needed to:

withdraw,
remove the PIN.

Without a PIN, a withdrawal needs no more than a tap in your private chat (Withdraw). That means whoever holds your Telegram account can withdraw your money; the daily withdrawal limit still applies.

Good to know:

Prysm only ever asks for your PIN in our private chat, never in a group.
The message you type your PIN in is deleted straight away.
Easy PINs (runs like 123456, repeats, common patterns) are refused.
Too many wrong PINs lock it for a while. After repeated lockouts it stays locked until Support resets it (see Forgot your PIN).
Change PIN and Remove PIN are on the same screen.

Forgot your PIN

Prysm can’t look up your PIN, and nobody can tell you what it was. Ask Support to reset it instead:

Support first checks that the request really comes from you, so expect a question or two about your account.
After the reset you have no PIN, and withdrawals wait for a while (Prysm’s message tells you how long). This protects you if someone else got into your Telegram account and asked for the reset.
Prysm sends you a message when your PIN is reset. You can then set a new one in Security.

If you get that message and you didn’t ask for a reset, contact Support straight away.

Choose who can send you USDC

The Receive transfers row in Security shows who can send you USDC with /send; tap Open on it to change it: Everyone (the default), Allowed only (just the people on your list) or No one. See Send to Other Users for how the list works.

Watch out for fakes

Prysm never emails you, never asks for a key or seed phrase, and never asks you to sign a message to verify; ignore anyone claiming to be Prysm or our wallet provider, in a DM, a group, an email or on a website.

If you’re unsure whether a message is real, ask through Support.