Samourai Wallet GitHub: Official Repos, Mirrors, Status
Samourai Wallet was one of the most recognized privacy-focused Bitcoin wallets before U.S. federal authorities seized its domain and arrested its founders in April 2024. Since then, finding the Samourai Wallet GitHub repositories has become a confusing task. Some repos were archived, others forked by community members, and the official project infrastructure no longer operates as it once did.
If you're here, you probably want to know what's still accessible, where to find mirrors of the source code, and whether any of it is safe to use. Those are fair questions, especially if you previously relied on Samourai for transaction privacy or are researching its codebase for technical reasons. The answers aren't as straightforward as a simple link, though, because the project's legal status directly affects its code availability.
At FinTech Dynasty, we cover the security side of crypto ownership, from hardware wallets to the software tools people use for self-custody. Samourai Wallet's situation is a real-world case study in what happens when open-source wallet infrastructure gets pulled out from under its users. This article breaks down the current state of every known Samourai Wallet GitHub repository, including official archives, community-maintained forks, and what you should watch out for before downloading anything.
Why Samourai Wallet GitHub matters
For Bitcoin users who prioritize privacy, the Samourai Wallet GitHub repositories were never just a storage location for code. They were the foundation of trust. Open-source software lives or dies by the ability of anyone to read, audit, and verify what the code actually does before running it on a device connected to real funds. That accountability mechanism matters more for a privacy-focused wallet than almost any other type of software, because the entire value proposition depends on the code doing exactly what the developers claimed.
Open-source code as a trust mechanism
When you download a wallet application, you place significant trust in the people who built it. With closed-source software, you have no way to confirm that the app behaves as advertised. Open-source projects on GitHub let independent security researchers and developers inspect every line of code for backdoors, undisclosed data collection, or behavior that contradicts the project's stated privacy goals. Samourai Wallet built its reputation largely on this transparency, and its GitHub presence was the primary mechanism keeping that reputation credible.
The ability to audit source code is one of the few genuine assurances available in self-custody software.
Your ability to verify reproducible builds and cryptographic signatures is not a technical detail reserved for developers. It is the difference between trusting a marketing claim and trusting a mathematical proof. That distinction becomes critical when the people behind a project are no longer reachable.
What the April 2024 seizure changed
The U.S. Department of Justice arrested Samourai's co-founders in April 2024 and seized the project's primary web infrastructure. This created a specific and immediate problem for the open-source ecosystem around the wallet: repositories became frozen, development went silent, and community members scrambled to fork and preserve whatever existed at that moment. Active maintenance stopped, which means security patches and compatibility updates stopped alongside it.
Researching the repository history now requires a different approach than it did before the seizure. You need to know which repositories reflect the last verified state of the codebase, which community forks are maintained by identifiable contributors, and which mirrors introduce risks through unknown modifications. The sections ahead address each of those points directly.
How to find the official Samourai repos
The original Samourai Wallet GitHub organization operated under the username Samourai-Wallet on GitHub.com. Before the April 2024 seizure, this organization hosted the primary repositories for the wallet app, Whirlpool coinjoin implementation, and supporting backend tools. Those repositories still exist on GitHub but carry an archived status, meaning no new commits, pull requests, or issues are being processed by the original maintainers.
The original GitHub organization
You can search GitHub directly for the Samourai-Wallet organization to locate the archived repositories. The most relevant ones include samourai-wallet-android (the main wallet application) and Whirlpool (the coinjoin mixing coordinator). Go to github.com/Samourai-Wallet and browse the full repository list. Look specifically at the last commit date and the archived banner on each repository to confirm you are viewing the frozen original code rather than an active fork.
Archived repositories preserve the full commit history and release tags, which makes them more reliable starting points than forks with altered histories.
What to look for in archived repos
When you land on an archived repo, check the Releases section on the right-hand sidebar. This section lists version tags and any APK files the original developers attached to official builds. You should also review the commit history to identify the final verified state of the code before activity stopped.
Look for these signals that confirm you are on an original archived repository rather than a community mirror:
- The repository header shows a gray "Archived" banner
- The last commit date aligns with or precedes April 2024
- The organization name reads
Samourai-Wallet, not a personal account handle
How to verify code and releases on GitHub
Finding a Samourai Wallet GitHub repository is only half the task. Verifying that what you find matches what the original developers actually published is the more important step, particularly now that active maintainers are absent. Anyone can fork a repository and alter the code before repackaging it as an APK, and the modifications may not be visible without a deliberate check.
Check GPG signatures on releases
The original Samourai development team signed official releases with GPG (GNU Privacy Guard) keys, and those signatures are attached to release files in the Releases section of the repository. Before you install any APK, download the accompanying .sig or .asc signature file and verify it against the developer's published public key. A matching signature confirms the file was produced by whoever held the private key at the time of signing.
A valid GPG signature does not guarantee the code is safe going forward, but it does confirm the file has not been tampered with after the original release.
To run the verification, use the gpg --verify command in a terminal with the signature file and the APK side by side. If the output returns a "Good signature" result tied to a known developer identity, you can trust the file's integrity up to that release date.
Compare commit hashes to known-good versions
Each commit on GitHub carries a unique SHA hash that acts as a fingerprint. Cross-reference the commit hash on any repository you are reviewing against community-maintained records or archived discussions that document the final verified commit before the April 2024 seizure. If the hashes match, the code history is intact. If they diverge, someone modified the repository after the fact.
Repo map: what each Samourai project does
The Samourai Wallet GitHub organization hosted several distinct repositories, each serving a specific technical function within the broader privacy stack. Understanding what each one does helps you determine which parts of the codebase are relevant to your research and which ones you can safely ignore if you only need the wallet itself.
The core wallet and mixing repositories
The most important repository for end users is samourai-wallet-android, which contains the full source code for the Android application. This is the code that ran on your phone, managed private keys, and constructed transactions. Alongside it, Whirlpool handled the coinjoin coordination logic, allowing users to mix UTXOs and break on-chain transaction history. These two repositories represent the core functionality most people associate with Samourai.
The wallet and Whirlpool repositories are the highest-priority archives to locate if you are auditing Samourai's privacy claims at the code level.
| Repository | Function |
|---|---|
samourai-wallet-android |
Main wallet app, key management, transaction construction |
Whirlpool |
Coinjoin mixing coordinator |
whirlpool-client |
Client-side library for interacting with the Whirlpool server |
samourai-dojo |
Self-hosted backend node for transaction indexing |
Supporting tools and libraries
Beyond the wallet and mixing layer, the organization also maintained samourai-dojo, a self-hosted backend that let users connect the wallet to their own Bitcoin node rather than relying on Samourai's servers. This repository matters significantly now because the original Samourai servers are offline, making Dojo the only path to functional use of any surviving fork.
Current status, archives, and mirror risks
As of early 2026, the Samourai Wallet GitHub organization remains frozen. No new commits have been pushed to the original repositories since the April 2024 seizure, the Whirlpool mixing servers are permanently offline, and the founding team remains subject to ongoing legal proceedings. The project is not dormant in a recoverable sense. It is effectively suspended indefinitely, and you should evaluate any claimed "revival" with serious skepticism.
What the archived repositories still provide
The archived state of the original repositories is not without value. You can still access the complete commit history, all tagged releases, and any APK files the developers attached before the seizure. This makes the archives useful for code audits and historical research, even if running the software in a fully functional state is no longer straightforward without self-hosted infrastructure.
Archived code is a record, not a living product. Treat it as a reference, not an installation source.
The risk of unofficial mirrors
Community forks and third-party mirrors introduce risks that do not exist with the frozen originals. Anyone who copies a repository can modify the code, repackage it as an APK, and distribute it under the Samourai name without obvious disclosure. If you encounter a mirror claiming to offer updated or patched versions of Samourai, the first step is to verify GPG signatures against the original developer keys. If those signatures are absent or cannot be confirmed, you have no reliable assurance that the code matches what the original team wrote.
Next steps
The Samourai Wallet GitHub story is a clear reminder that even well-regarded open-source projects can disappear overnight when legal pressure hits. If you were relying on Samourai for privacy, your most practical next step is to assess your current setup and identify a replacement that is actively maintained and verifiable. Frozen code offers no forward security.
Before you move on, confirm that any wallet software you use today has an active development team, a current GitHub repository with recent commits, and signed releases you can independently verify. These are not optional checks. They are the baseline for trusting software with access to your funds.
If you want to build a stronger foundation in crypto security from the ground up, the FinTech Dynasty crypto education course covers wallet selection, self-custody principles, and how to evaluate the tools you rely on before committing real assets to them.