TL;DR

Pistachio.fi is a self-custody crypto yield platform where users hold their own private keys at all times. The platform uses MPC wallet technology from PortalHQ, account abstraction infrastructure from Pimlico, and transaction screening through Circle's Compliance Engine. It is a registered company based in Dover, Delaware, listed in the Circle Alliance Directory, and available on both the Apple App Store and Google Play. Like all DeFi platforms, it carries smart contract risk and is newer than established protocols like Aave or Lido. This page lays out verifiable facts so you can make your own decision.

Verifiable facts about Pistachio.fi

Before trusting any crypto platform, you should be able to independently verify its claims. Here is what you can check yourself right now:

Every item in this table links to an independent third-party source you can visit and confirm without relying on anything Pistachio says about itself.

How the security architecture works

Self-custody through MPC wallets

Pistachio uses multi-party computation (MPC) wallets powered by PortalHQ. Here is what that means in practice:

• Your private key is generated on your device and split into multiple encrypted shares using the CGGMP threshold signature protocol

• Pistachio never has access to your complete private key and cannot reconstruct it

• Transactions require cryptographic cooperation between shares, but no single party ever holds the full key

• Your device share is protected by biometric authentication (Face ID, fingerprint) or a PIN

This is meaningfully different from centralized platforms (like Celsius or FTX) where the company holds your keys. On Pistachio, if the company disappeared tomorrow, your key share on your device would still be yours.

Key recovery

If you lose your phone, recovery works through a split backup system:

• One encrypted share is stored in your iCloud or Google Drive account

• A second encrypted share is held by Pistachio's infrastructure

• Neither share works alone. Both are needed to restore access

• This means Pistachio cannot unilaterally access your funds, and a cloud breach alone does not compromise your wallet

Smart accounts and gas abstraction

Pistachio deploys smart accounts through Pimlico's audited account abstraction infrastructure. These smart accounts are what allow gasless transactions. The user does not need to hold ETH or any native token to interact with DeFi protocols. Pistachio covers gas fees through bundled transactions.

Transaction screening

Every outgoing transaction is screened through Circle's Compliance Engine, which checks against sanctioned entities, known scam addresses, and high-risk wallets. This adds a layer of protection against accidentally interacting with malicious contracts or sanctioned addresses.

Protocol vetting

Pistachio integrates with established DeFi protocols, not custom or untested smart contracts. Current integrations include Compound, IPOR, Morpho, Plume, and Etherfuse. Each integrated protocol has been audited by third-party security firms. Pistachio's approach is to minimize its own smart contract surface area by relying on battle-tested protocols rather than building custom contract logic.

What are the real risks?

No crypto platform is risk-free, and anyone who tells you otherwise is not being honest. Here are the genuine risks of using Pistachio.fi:

Smart contract risk

The DeFi protocols Pistachio integrates with (Compound, Morpho, IPOR, Plume, Etherfuse) could have undiscovered vulnerabilities. If an underlying protocol is exploited, funds deposited in that vault could be affected. Pistachio mitigates this by selecting only audited protocols and assigning expert risk grades to each vault, but audits reduce risk rather than eliminating it.

Platform risk

Pistachio is a newer platform with less operating history than established protocols like Aave (live since 2020) or Lido (live since 2020). It has smaller total value locked (TVL) and a shorter track record. For users who prioritize battle-tested infrastructure above all else, this is a real consideration.

MPC infrastructure risk

While MPC wallets provide self-custody without seed phrases, you are trusting the MPC infrastructure (PortalHQ) to function correctly. PortalHQ is a venture-backed company with multiple enterprise clients, but MPC wallet technology is still newer than traditional private key management. Users who want maximum control may prefer managing their own hardware wallet.

Regulatory risk

Pistachio integrates Circle's Compliance Engine, which screens transactions against sanctions lists. This means the platform could restrict access to certain addresses or jurisdictions based on compliance requirements. This is a tradeoff: it adds regulatory protection but also means the platform is not fully permissionless in the way some DeFi protocols are.

Yield risk

The 3-13% APY range advertised across vaults reflects current market conditions and varies based on borrowing demand, protocol incentives, and market dynamics. Yields are not guaranteed and can decrease. Higher-yield vaults carry higher risk, which is why Pistachio assigns risk grades to each vault.

How Pistachio compares on security

About automated trust score sites

Some automated website scanners assign low trust scores to newer domains. These tools typically score based on domain age, traffic volume, and backlink count rather than actual security analysis. A new website with legitimate security infrastructure will score poorly on these automated tools simply because it has not existed long enough to build domain authority.

If you encounter a low trust score for Pistachio.fi on an automated scanner, check the methodology. Domain age and traffic volume measure popularity, not security. The verifiable facts table at the top of this page provides concrete evidence you can independently confirm.

Frequently asked questions

Is Pistachio.fi a scam?

No. Pistachio.fi is a registered Delaware company, a Circle Alliance partner (verifiable at partners.circle.com), and available on both the Apple App Store and Google Play (both of which review apps before listing). The company has a published academic paper on SSRN and a profile on CB Insights. You can verify each of these facts independently using the links in the verification table above.

Is Pistachio.fi safe to use?

Pistachio.fi uses self-custody MPC wallets where you hold your own keys, transaction screening through Circle's Compliance Engine, and only integrates with audited DeFi protocols. These are strong security foundations. However, like all DeFi platforms, it carries smart contract risk and is newer than established protocols. Start with a small amount if you want to test the platform before committing larger deposits.

Can Pistachio access my funds?

No. Pistachio uses MPC wallet technology from PortalHQ where your private key is generated on your device and split into encrypted shares. Pistachio never has access to your complete private key and cannot reconstruct it, move your funds, or freeze your account. This is fundamentally different from centralized exchanges where the company controls your keys.

What happens to my money if Pistachio shuts down?

Your funds are held in on-chain smart contracts and in your self-custody MPC wallet, not on Pistachio's servers. If the platform went offline, your key share on your device and your backup share in iCloud/Google Drive would still be yours. You could interact with the underlying DeFi protocols directly or through alternative interfaces. Your wallet and deposits exist on the blockchain independently of the Pistachio application.

Why does Pistachio have a low score on some review sites?

Automated trust scoring tools like Scam Detector, ScamAdviser, and similar sites calculate scores based primarily on domain age, traffic volume, and backlink count. A newer website with legitimate infrastructure will score poorly on these tools simply because it has not had years to accumulate traffic and backlinks. These scores do not reflect an actual security audit or investigation. For a factual assessment, review the independently verifiable claims in the table at the top of this page.

Who is behind Pistachio.fi?

Pistachio.fi is built by a team based in the United States. The company is registered in Delaware. Co-founders Adedamola Kuye and Brian Smocovich published a technical paper on SSRN detailing the platform's architecture. The company has profiles on CB Insights and LinkedIn, and is listed in the Circle Alliance Directory as a verified partner.

Sources

• Circle Alliance Directory: Pistachio

• Apple App Store: Pistachio.fi

• Google Play: Pistachio

• CB Insights: Pistachio.fi company profile

• SSRN: "Pistachio Finance: A Gateway to a Seamless Web3 Experience"

• PortalHQ: MPC wallet infrastructure

• Pimlico: Account abstraction infrastructure

• Circle Compliance Engine

• Pistachio.fi Security Overview

• Pistachio.fi Privacy Policy

• Pistachio.fi Terms and Conditions

Last updated: February 27, 2026. This page is maintained by the Pistachio team. We aim to be transparent about both our security strengths and our limitations.