Trust nothing. Verify everything.
Two checks stand between a fresh download and an installer worth running: the SHA-256 checksum and the OpenPGP signature. Do both, in order, every time.
Download the installer and its verification files
From the Releases page, download three files for your platform: the installer, the .sha256 checksum file and the detached OpenPGP signature .sig.
Save all three files in the same folder. Do not rename them.
Compare the SHA-256 checksum
Compute the SHA-256 of the installer locally and compare it to the value published on the release page. The two must match character by character.
Get-FileHash .\BounceBitWallet-Setup.exe -Algorithm SHA256certutil -hashfile BounceBitWallet-Setup.exe SHA256shasum -a 256 BounceBitWallet.dmgsha256sum BounceBitWallet.AppImageVerify the OpenPGP signature
The signature proves the installer was released by the holder of the BounceBit Wallet signing key. Import the signing key once, then verify the detached signature against the installer.
gpg --import bouncebit-wallet-signing-key.ascgpg --verify BounceBitWallet.dmg.sig BounceBitWallet.dmgThe fingerprint is published on the release page. Compare the fingerprint reported by gpg --verify to the value on the release page. They must match exactly.
Install with confidence
Only run the installer once both the SHA-256 and the OpenPGP signature check succeed. Any single failure means the file must not be installed.
Delete the file. Do not install.
A mismatch means the installer was modified or the download was tampered with. Delete the file, download the installer again from the release page and repeat the checks. If the mismatch persists, contact support — never through an unsolicited channel.