FAQ
Non-custodial wallet — how it works and your safety.
What is a non-custodial wallet and how does BombPilot use it?
Non-custodial means you control your keys. BombPilot never holds your private key, seed or password — nor your funds. We cannot move your tokens or NFTs.
How does the client play?
You sign one message in your wallet (MetaMask/WalletConnect). Signing a message does not move funds nor grant access to your key — it only proves the wallet is yours. From that signature, the BombCrypto server issues a session token, and it is that token the client uses to play, just like the official client.
So what do you store?
Only the game session token (encrypted, AES-256, key only on the server). It grants access to play on behalf of the account — not to your on-chain wallet. We do not store keys or seeds.
Is signing the login safe? Can it steal my funds?
The signature is a text message (EIP-191), not a transaction. It does not authorize transfers nor approve spending. Golden rule: login is always signing a message, never a transaction.
Can I revoke access?
Yes — unlink the account in the panel at any time and the stored token is discarded. Sessions also expire on their own.
Can BombPilot withdraw/transfer my BCOIN/SEN/NFT?
No. Withdraw/claim and on-chain transfers require your wallet’s signature — which only you provide. The client never signs any transaction for you.
Do I ever need to send my seed phrase?
NEVER. BombPilot (nor any legitimate service) will ever ask for your seed or private key. If someone asks, it’s a scam.
Is payment also non-custodial?
Yes. You pay directly from your wallet to the payment address. BombPilot only reads the blockchain to confirm — it never holds or intermediates your funds.