HostHostDeFi › Guides › Fake wallet apps & extensions
Fake wallet apps & extensions
The most efficient crypto theft requires no exploit: ship a wallet that looks right, wait for someone to restore, receive their seed phrase. Here's the distribution playbook and the verification that beats it.
Every drain needs a moment where the victim hands over access — and a fake wallet is the only attack where the victim does it during installation. You search for the wallet you meant to get, you tap the convincing result, you "restore" your existing wallet into it, and the app relays your seed phrase to the operator before your balance finishes loading. The fake doesn't need to work well — it needs to survive for the thirty seconds until you type twelve words.
How the fakes get in front of you
Cloned listings
Lookalike apps slip into mobile app stores under names like "Phantom WaIIet" or a swapped logo and a cloned screenshot set. They ride a burst of bot installs and five-star reviews for legitimacy, harvest phrases for weeks, get reported, and respawn under a new publisher. The store is a host, not a vetter.
Spoofed extensions
Chrome Web Store clones of MetaMask-class extensions request "read and change all your data on all websites" — the permission the real one needs, and the permission that also lets a fake read whatever you type into it. Some are outright phrase harvesters; the subtler ones behave like the real wallet for months, then swap a receive address or ship a malicious update once they hold enough balances.
Ads above the answer
Search ads and promoted posts buy the slot above the real download link — the highest-converting phishing real estate that exists, because the clicker already decided to install something. A domain that's one character off the real one completes the illusion.
"Mobile version just launched"
Fake announcements in Telegram and Discord, "support" replies under complaint tweets, and DM'd links to "the new beta" — all resolving to sideloaded APKs or clone-store listings. The impersonation layer that delivers these links →
Verify before you install — the actual checklist
Navigate from the source, not to it. Start at the project's official site or its verified social profile and click their link to the store — never the reverse direction. A store page claiming to be a project proves nothing; the project's site pointing to a store page proves everything it can.
Check the publisher, not just the name. The listing name is costume; the publisher account is identity. Real wallets ship under a consistent publisher identity with a real domain, a real install count measured in millions, and version history going back years — not a fresh account with three apps and nine reviews.
Read the install count and the dates. The real MetaMask/Phantom-class listings carry installs in the millions and years of updates. A clone launched last Tuesday with 10k installs is a clone until proven otherwise — and "new official mobile app" announcements that aren't echoed on the project's real channels are bait.
Audit extension permissions honestly. A wallet extension legitimately needs broad page access — which is exactly why the publisher check carries the weight. If you can't verify the publisher to your own satisfaction, don't install; an unverified wallet is not "probably fine," it's an unsigned cheque.
The restore trap: a fake wallet's entire business model is the moment you choose "I already have a wallet" and type your phrase. Treat any seed entry as a nuclear action — only inside software you verified before installing, on a device you trust, with the phrase never passing a website form, a chat, or a cloud-synced field. If you're not certain the app is genuine, do not restore into it — create a throwaway wallet first and watch what the app asks for.
If you already installed one
Assume the phrase is captured the instant you typed it — malware doesn't wait, and neither should you. The move order: on a clean, verified wallet on a different device, generate a brand-new phrase, transfer every asset out of the exposed wallet to the new addresses (most valuable first — the drainer may already be racing you), then uninstall the fake and never touch the old phrase again. If funds are already gone, the drained-wallet playbook covers the first hour →. And check what the fake may have signed on your behalf — stray approvals outlive the app →.
The browser is the weaker vault
Extensions are the riskiest home a wallet has — they hold your keys inside the same process space as every hostile webpage, and a fake one gets your phrase typed straight into its own form. Hardware wallets move signing out of the extension's reach (the phrase never enters the browser at all), which removes this whole class at the device layer — when hardware actually helps, and where it doesn't →. Whatever you use, the burner/vault split caps what any single compromised install can reach.
Suspicious token, suspicious app — check both
The token side is checkable in seconds: paste the contract and read the authorities, liquidity, and holder spread before it ever meets a wallet.
Frequently asked
How do fake wallet apps steal crypto?
You 'restore' into them during setup, type your seed phrase, and the app relays it to the operator. Some work normally for weeks, then steal via address substitution or a malicious update.
Can fakes get into official stores?
Regularly — lookalike names, copied screenshots, bought installs, bot reviews. A store listing proves nothing; publisher identity and install history are the signal.
Fastest way to verify a wallet download?
From the project's official site, follow their link to the store — then check publisher account, million-scale install counts, and years of version history.
I restored into a fake wallet — now what?
Phrase = public. Clean verified wallet on another device, new phrase, move every asset valuable-first, uninstall, check signed approvals, retire the old phrase.
Are extensions riskier than mobile apps?
Yes — they live inside hostile webpages and legitimately hold broad page permissions. Hardware wallets kill the class because the phrase never enters the browser.