Fake wallet apps: how to verify a wallet download
Fake wallet apps copy well-known brands and steal your seed phrase when you set up or restore. They have repeatedly passed review on Apple, Google, Microsoft and Linux app stores. Reach the app through the official domain you type yourself, check the developer, and never restore a large wallet in an app you are unsure about.
Fakes that got through official stores
| Date | Store | What happened | Source |
|---|---|---|---|
| Jan–Feb 2021 | Apple App Store | Fake "Trezor" app harvested seed phrases; one victim lost 17.1 BTC | Malwarebytes, Apr 2021 |
| Dec 2022 | Phishing sites (Android APK) | Trojanized BitKeep APKs stole private keys, about $8M; the Google Play version was not affected | Halborn, Dec 2022 |
| Oct 2023 | Microsoft Store | Fake Ledger Live stole about $768K | Bitdefender, Oct 2023 |
| Feb 2024 | Ubuntu Snap Store | Fake Exodus snap stole recovery phrases; a fake Ledger Live snap had appeared in 2023 | popey.com, Feb 2024 |
| Sep 2024 | Google Play | Fake "WalletConnect" app drained about $70K over five months | The Hacker News, Sep 2024 |
| Feb 2025 | App Store and Google Play | SparkCat SDK in apps scanned photo galleries for recovery phrase screenshots | The Hacker News, Feb 2025 |
| Mar–Apr 2026 | Apple App Store | Kaspersky found 26 phishing apps impersonating wallets | Malaysian Wireless, Apr 2026 |
| 7–13 Apr 2026 | Mac App Store | Fake Ledger app; about $9.5M stolen | iThinkDiff, Apr 2026 |
| Jul 2026 | Apple App Store | Lawsuit over fake "Sparrow Wallet" iOS apps (real Sparrow has no iOS app); about $1.8M alleged | BleepingComputer, Jul 2026 |
Fake "download" and "login" pages are also common in search ads and on free website builders, where they imitate official wallet guides.
How to verify a wallet download
- Start from the official domain. Type it yourself or use a bookmark you saved earlier. Each of our reviews names it as plain text (for example metamask.io, trustwallet.com, ledger.com, trezor.io, electrum.org, exodus.com). Ignore ads above search results.
- Follow the site's own store links. Don't search the app store by name; impostors use the same name and icon.
- Check the publisher. The developer name should match the company (for example MetaMask's extension is published by MetaMask, Trezor Suite by Trezor). Look at install counts, listing age and review history. A big brand with a few hundred installs is a fake.
- Check the platform exists. If the company doesn't offer an app for that platform (Sparrow, for example, has no iOS app), any app claiming to be it is fake.
- Verify signatures for desktop software. Projects such as Electrum and Trezor Suite publish signatures for their downloads. Verifying them proves the file came from the developers. Follow the instructions on the official site.
- Be suspicious of updates you didn't expect. Electrum users were targeted from December 2018 by malicious servers that displayed fake "update" messages linking to trojanized wallets, costing more than 771 BTC (Malwarebytes, Apr 2019). Update only from inside the app or the official site.
Hardware wallets: the companion app is the target
A hardware wallet should never ask you to type your recovery phrase into a computer or phone. If a "Ledger" or "Trezor" app asks for it to "sync", "validate" or "restore", it is a fake. Restore only on the device itself. Buy devices from the manufacturer or authorised resellers; in October 2026 Ledger confirmed seed-stealing implants in devices sold through a grey-market reseller (Crypto Briefing, Oct 2026).
Browser extensions
- Install from the official site's link to the Chrome Web Store, Firefox Add-ons or Edge Add-ons.
- Check the extension ID or publisher against the official site where listed.
- Remove extensions you don't use; each one can read pages you visit.
- Even genuine extensions can be compromised. In December 2025 a malicious Trust Wallet extension version 2.68 was published to the Chrome Web Store outside Trust Wallet's release process (BleepingComputer, Dec 2025). Follow your wallet's official channels for alerts.
If you installed a fake
- If you entered a seed phrase into it, create a new wallet in a verified app (ideally on a hardware wallet) and move all funds immediately.
- Uninstall the app and run a malware scan.
- Report the listing to the store and the impersonated company.
- Report losses to police; keep transaction hashes and screenshots of the listing.
Frequently asked questions
Are wallets on the Apple App Store and Google Play always safe?
No. Fake wallet apps have passed review on both stores, as well as the Microsoft Store and Ubuntu's Snap Store. Use the link from the official website and check the developer name.
How can I tell if MetaMask or Trust Wallet is real?
Reach it from the official domain you type yourself, then check the store listing's publisher name, install count and age. A fake usually has few reviews or a recent listing date.
Does the Ledger app ever ask for my 24 words?
No. Ledger says it never asks for your recovery phrase. Any app, letter or email asking for it is a scam.
What does verifying a signature mean?
Checking a cryptographic signature published by the developers proves that a downloaded file is unmodified and came from them. Electrum and Trezor Suite publish signatures and instructions.
Can a fake app steal funds without my seed phrase?
Some fakes only steal when you enter a phrase; others ask you to sign malicious transactions or replace addresses. Never enter a phrase into an app you are unsure about.