How do fake wallet apps get into app stores?

Attackers submit apps with names and icons nearly identical to legitimate wallets, but with slight variations. App store review processes are imperfect and can miss these. Some fake apps also use compromised developer accounts. Once live, they may run benignly for a time to accumulate reviews before activating malicious functionality.

What does a fake wallet app do?

Fake wallet apps typically capture your seed phrase when you enter it during 'setup' and immediately transmit it to the attacker's server. Some generate addresses controlled by the attacker rather than you — you can receive funds but the attacker can withdraw them at any time.

How do I find the real download link for a wallet?

Navigate to the wallet's official website (e.g., metamask.io, exodus.com, ledger.com) and click their app store link from there. Never search for wallets directly in the App Store or Google Play and click the first result.

Is it safe to download a wallet from the App Store or Google Play?

It is safer than random websites, but not foolproof. Fake apps do appear in both stores and may have significant ratings if the attack is recent. Always verify the developer name matches exactly, check the publisher's website link in the listing, and download via the official website's link.

Security · Scams

Fake Crypto Wallet Apps Explained

Fake wallet apps have stolen millions from users who thought they were downloading the real thing. Here is how they work and how to avoid them.

By Ashir Khan2 min read

Ashir Khan writes about cryptocurrency security, self-custody, macro market analysis, and regulatory policy at CryptoBeacon.

Last updated: September 1, 2026

How fake wallet apps work

Fake wallet apps are near-perfect visual clones of legitimate wallets — MetaMask, Trust Wallet, Exodus, Phantom, Ledger Live. They look identical on the app store listing and inside the app itself. The attack mechanism is simple: when you enter your seed phrase to "set up" or "restore" the wallet, the app captures it and transmits it to the attacker's server.

Some fakes go further: they generate wallet addresses that appear to belong to you but are actually controlled by the attacker. Any funds sent to those addresses are immediately accessible to the attacker.

How they appear in app stores

App stores review submissions but the process is imperfect. Attackers use several tactics:

Near-identical names: "MetaMask - Crypto Wallet & DeFi" vs "MetaMask - Crypto Web3 Wallet"
Purchased reviews: Fake five-star reviews to appear legitimate initially
Delayed activation: App works normally for weeks, then malicious code activates via an update
Compromised developer accounts: Gaining access to legitimate developer accounts and pushing malicious updates

How to verify a legitimate wallet app

Start at the official website

Navigate to the wallet's official website (verify the URL carefully). Find the 'Download' or 'Get the App' page and click their link to the app store. This is the only reliable source.

Check the developer name exactly

In the app store listing, the developer name must match exactly. MetaMask is published by 'ConsenSys'. Trust Wallet by 'DApps Platform Inc'. Search for this on the wallet's website before downloading.

Verify the publisher website link

App store listings show a developer website. Tap/click it and verify it matches the wallet's official domain.

Check the download count and history

Real wallet apps have millions of downloads and have existed for years. Be suspicious of an app with few downloads or a recent creation date.

Never restore from an unsolicited recommendation

If someone in a Telegram group, Discord, or forum recommends a specific app link, do not use it. Find the app independently via the official website.