Fake wallet app

Fraudsters copy the name, logo and screens of popular wallets and publish them through sponsored search ads, lookalike websites, third-party app stores and occasionally official stores before they are removed. Fake browser extensions appear in extension marketplaces with inflated reviews. Once installed, the app asks the user to import an existing wallet or simply records the phrase of a new one and sends it to the attackers.

Some variants are subtler: modified versions of open-source wallets that work normally but generate keys known to the attacker, or apps that swap the destination address when the user sends funds. Mobile users who cannot reach official stores in their country, or who follow a link sent in a chat, are especially exposed, and pig butchering networks often distribute such apps directly.

Store presence is not proof of legitimacy. The safest route is to start from the wallet's official website and follow its link to the store or extension page, checking the developer name and download count. Hardware wallets are also counterfeited, so devices should come from the manufacturer or authorised resellers and arrive without a pre-filled recovery sheet.