We could move your name. Now you can see if we do.
A bWalletX name is a row in our database, so we could point it at another key. On 17 Oct we did, for the owner’s own names. Now names are signed by their owners, and every change goes in a public log.
What happened
Our owner, Richard, has two wallets. Two of his names, npg@bwalletx.com and ninjapunkgirls@bwalletx.com, were on the wrong one. Early on 17 October he asked us to move them. We did it the quick way: we edited the name directory in our database by hand. A few minutes later we gave a third name, npgx, to his NPGX wallet the same way.
Nothing else changed hands. No coins moved. Nobody lost anything. The names were his, on his wallets, at his request.
But it took one line of SQL. And no one outside could have seen it.
Why that matters
bWalletX never holds your keys or your coins. Payments go from one wallet to another. That part is true and stays true.
Your name is different. alice@bwalletx.com is a row in our database that says which key the name points to. If we, or someone who broke into our server, pointed that row at another key, future payments to $alice would go there instead. Past payments are safe. Future ones are not.
Every paymail service works this way. We had not said it out loud. Moving the owner’s names made it obvious, so we fixed what we could the same day, and we are saying it now.
What we built
Signed names. Your wallet now signs a short statement: “this name points to my key, version 1”. Our name server hands that out with your key. We can’t make that signature for a key we don’t hold. Before any payment to a bWalletX name, the paying wallet checks it:
- Signed by its owner: all good.
- Not signed by its owner yet: a grey note; the payment still goes. Wallets sign their own names the next time they open.
- Bad signature: the payment is blocked.
A public name log. Every change of who a name points to is written to a log that can only be added to. Each entry carries the hash of the one before. The database writes the entries itself, so even a hand edit by us is logged, marked admin. Anyone can read it:
curl https://pay.bwallet.space/api/paymail/name-log
curl "https://pay.bwallet.space/api/paymail/name-log?alias=npg"The first three entries are our edits from 17 October: two moves and one new name, all marked admin, each with a note saying why.
Standing on others’ work
Signed names are not our idea. BRC-169 already binds handles to keys with a certificate from the host, and warns before paying a name whose key has changed; we plan to adopt that warning too. BRC-174 specifies on-chain names held in your wallet, which is where we are headed. The paymail standard already lists “alias reassignment” by whoever has the server and database. And public logs that keep operators honest come from Certificate Transparency.
Our part is small: the owner signs, not the host; the signature rides in the paymail answer wallets already fetch; and the log catches our own database edits.
What this doesn’t fix yet
- We still serve the signatures and the log. We could hold a signature back; the name would then show “not signed”.
- We could serve an older genuine signature; its version number would give it away against the log.
- Until the log is anchored on chain, it lives in our database. The hash chain shows tampering only to someone who kept an earlier copy.
What’s next
Once a day, the log’s latest hash goes into a Bitcoin transaction, so no one can rewrite it after the fact, us included. And for names that must never depend on us, OpNS names live on chain in your own wallet.
We have also written the scheme up as a draft, so any paymail service could sign its names the same way. We have raised it with the authors of BRC-169 and BRC-174 in BRCs issue #329, asking whether it belongs inside their work.
Status, 17 Oct 2026
- ✓ Signed names: wallets sign their own names and check names before paying
- ✓ Bad signatures block payment
- ✓ Public name log, hash-chained, with our 17 Oct edits as its first entries
- ✓ Handovers need both wallets: the owner releases, the new wallet accepts
- ✓ No back door for lost keys
- ✓ Key-change warning before paying
- ✓ Proposed to the BRC authors (issue #329)
- ◻ Daily on-chain anchor of the log
- ◻ OpNS names in the wallet
How to check a name yourself, with code: Signed names.