Skip to content
Last updated 2026-11-05

Phishing App Scam

A phishing app copies the look of a wallet you trust, then adds one request the real one never makes: your recovery phrase, or a signature you did not mean to give. Verify the publisher and the install source before the first launch.

Who this is for

Anyone installing a wallet on a new phone, accepting a beta invite, or answering a message that says an app needs an update.

How the scam works

Four delivery routes do most of the work.

Cloned store listings. The name gains a suffix — Pro, Plus, Update, 2 — and the icon and screenshots are copied. Reviews are cheap to buy. The developer name is the detail that does not match.

Sideloaded packages. An APK or an iOS build arrives in a chat, usually framed as the version that supports a new network, the version that fixes a bug, or a build for users in your region. It never passed store review, and it can ask for permissions a store would flag: drawing over other apps, reading notifications, or accessibility control.

Beta invites. A TestFlight-style invitation feels like proof of authenticity because it comes through a vendor's beta program. In practice anyone can distribute a build through a beta channel, and a lookalike invite leads to an unreviewed app.

Fake update prompts. A banner inside an app, or a page that imitates the wallet's site, says the wallet is out of date and links to a download. The real update path is the store listing or the vendor's own site, not a link that appeared while you were using the app.

Once installed, the app behaves plausibly. It shows a balance, a receive address, and a send screen. It captures the phrase at launch, or routes a connection to a drainer contract, and the theft happens later.

Warning signs

  • The publisher differs from the vendor's official site, even when the icon and the name look right.
  • The listing is recent, has few installs, or has reviews that repeat the same sentence.
  • The install file arrived by message, or from a page that is not the store.
  • An update prompt appears inside the wallet or on a web page, rather than in the store.
  • The app asks for permissions unrelated to holding a key, or for a device management profile.
  • Any screen asks you to enter a phrase to "restore", "sync", "unlock", or "verify" a wallet.

If it happens to you

  1. Stop using the app. If a phrase was entered, assume it is compromised and create a new wallet on a clean device.
  2. Move remaining funds to the new address, then revoke approvals held by the old one.
  3. Remove the app and any profile or device-administrator entry it installed.
  4. Change passwords for accounts used on that device, starting with email.
  5. Report the listing, the invite, and the domain to the store and to the vendor.

The update that asks for a phrase

No update needs your recovery phrase. An app that already holds your wallet can update without it, so a prompt asking for one is describing a reinstall, not an update.

Next steps

Self-check

  • Do you know the exact publisher name of the wallet you use?
  • Would you install a build sent to you by someone you met online?
  • Do you update apps only from the store, never from a link?
  • Can you name the permissions your wallet actually needs?