Fake Wallet Apps and Extensions: How Counterfeits Work
How counterfeit wallet apps and extensions reach people, what they do once installed, how to find the genuine download, and what to do if a phrase was exposed.
A counterfeit wallet is not a broken wallet. It is a working piece of software built to look like the wallet you meant to install, and its purpose is to collect the recovery phrase or private key you type into it. The screen it shows is often a faithful copy of the real onboarding flow: create a new wallet, or restore an existing one. The difference is where the words go after you press continue. Understanding that mechanism is more useful than memorising a list of scam links, because the next variant will use a different link.
How counterfeit wallets reach people
Most counterfeit downloads arrive through one of four channels. Each relies on the user being in a hurry and trusting a surface that looks official.
Search ads. A search for a wallet name returns sponsored results above the organic ones. The advertiser buys the brand term and points the ad at a lookalike site. The domain is often one character off, or uses a different top-level domain, or adds a word like -wallet or -app.
Lookalike store listings. Mobile app stores and browser extension stores accept submissions from anyone. A counterfeit can use a similar name, a similar icon, and screenshots copied from the genuine listing. Store review processes catch some of these and miss others; listings can also be taken over or replaced after approval.
Links in support chats. Someone posing as support in a chat app, a forum, or a social media reply sends a link to a download page. The pretext is usually a problem you did not report, such as a pending transaction or a wallet that needs an update.
Links in videos and posts. Tutorials, sponsored segments, and comment replies carry download links. A video can be genuine in every other respect and still carry a link added by someone else, or a description edited after publication.
The common thread is that the link is the attack surface. The counterfeit does not need to break into your device; it needs you to install it and trust it.
What the fake does once installed
A counterfeit wallet typically presents a normal onboarding screen. It offers to create a new wallet or to restore an existing one. If you choose restore, it asks for your recovery phrase, exactly as a genuine wallet would. Whatever you type is transmitted to the operator, often alongside the wallet address derived from it, so the operator can monitor the balance and sweep it later.
Some counterfeits go further. They may show a plausible balance, allow you to receive funds, and even display a transaction history. This is deliberate: a wallet that appears to work is a wallet you keep using, and a wallet you keep using is one whose phrase you may eventually enter again. Others ask for the phrase a second time under the pretext of a “verification” or “sync” step.
Browser extensions add a second mechanism. An extension runs inside the browser and can read and modify the pages you load. A counterfeit extension can replace the address you paste into a send field with one controlled by the operator, or alter what a signing prompt displays so that the transaction you approve is not the one you read. The phrase-collection screen is the simplest version; address replacement and prompt tampering are the ones that catch people who never typed a phrase into anything.
Reaching the genuine download
The reliable route is to type the project’s own domain by hand into the address bar, rather than following a link from a search result, an ad, a chat, or a video. From that site, follow the project’s own link to its store listing. That chain — typed domain, then the project’s link — is harder to counterfeit than any single step, because it does not depend on a search ranking or a store search result.
When you reach a store listing, check the publisher name against the name the project states on its own site. A listing’s developer name is a stronger signal than its title, because titles are easy to imitate and publisher identities are not. Review counts and download numbers are weak signals: they can be inflated, copied from a genuine listing’s screenshots, or inherited by a listing that changed hands. A high number tells you a listing has been seen a lot, not that it is the one you want.
| Signal | Useful when | Does NOT apply when |
|---|---|---|
| Domain typed by hand from the project’s own site | Always, as the starting point | You arrived via a search ad, chat link, video description, or QR code |
| Publisher name matches the project’s stated publisher | The project names its publisher on its own site | The project has not stated a publisher, or the listing’s publisher is a different entity |
| Store listing reached from the project’s own site | The link on the site points to the listing | You searched the store by name and picked a result |
| Review count and download count | Rarely, and only alongside other signals | Used alone, or as the main reason to trust a listing |
| Icon and screenshots | As a quick check once other signals agree | Used as the primary check; both are copied easily |
What to do if a phrase was already entered
If a recovery phrase was typed into a counterfeit app or extension, treat every key derived from that phrase as exposed. The operator has the phrase; anything the phrase controls can be moved by the operator at any time. Changing a password does not help, because the phrase is the key, not a login.
The response is to move funds to a newly generated wallet. Generate the new wallet on a device you trust, using software you reached through the route described above, and let it produce a fresh phrase on the device. Do not reuse the exposed phrase for the new wallet, and do not derive new addresses from it. Move the assets, confirm the new wallet receives them, and then stop using the old one.
If the exposed phrase controlled accounts on multiple chains or in multiple wallets, each of those needs the same treatment, because the phrase is the same key material across all of them. Where an asset cannot be moved without a delay, such as a staked position with an unbonding period, the exposure window is longer and the operator may act first; that is a reason to start the move immediately rather than to wait.
What people get wrong
The common misdiagnosis is that the counterfeit was obviously fake and the victim was careless. In practice the fake is often indistinguishable at the moment of installation: the icon matches, the onboarding flow matches, and the link arrived from a surface the user had reason to trust. The mistake is structural — a search ad, a store search, or a chat link is treated as a source of truth about which software is genuine. That is a natural mistake, because those surfaces are reliable for most software categories and because the counterfeit is designed to survive exactly the checks a hurried user performs.
A second misdiagnosis is that a wallet which displays a balance and a transaction history must be genuine. A counterfeit can show whatever it likes; the display is not evidence of control. The only evidence that matters is whether the software you installed was the software the project publishes, reached by a route the project controls.
A third is that removing the app or extension undoes the exposure. Uninstalling stops the counterfeit from running on your device; it does not retrieve the phrase the operator already received. Removal is necessary and not sufficient.
Checking what an extension can do
Browser extensions declare permissions, and the declaration is visible before installation and in the browser’s extension manager afterwards. A wallet extension that requests permission to read and change data on all sites has broad access; that is sometimes legitimate for a wallet that injects a provider into pages, and it is also the permission a counterfeit needs to tamper with send fields. Reading the permission list does not tell you whether an extension is genuine, but it tells you what the extension could do if it were not.
chrome://extensionsOpen the extension manager and review the list. Each entry shows its publisher and its permissions; an entry you do not recognise, or one whose publisher does not match the project’s stated publisher, is a reason to disable it and investigate before using the wallet again.
chrome://settings/searchEnginesA counterfeit can also arrive as a modified browser or a changed default search engine that redirects wallet-related searches to lookalike sites. Reviewing the search engine list shows whether an unfamiliar entry has been added; an entry you did not add is a sign the browser itself has been altered.
Aftermath and hygiene
If a phrase was exposed, the priority is moving assets to a newly generated wallet, not investigating the counterfeit. Investigation can follow. Report the listing or ad to the store or platform that carried it, because removal reduces the number of people who encounter the same link, but do not wait for a response before moving funds.
For future installs, keep the route consistent: type the project’s domain by hand, follow the project’s own link to the store, and check the publisher name against what the project states. Treat search ads, chat links, video descriptions, and QR codes as untrusted for wallet downloads regardless of how official they look. Store review counts and download numbers do not substitute for that route.
Common questions
How can I tell if a wallet app is fake?
Check the publisher name on the store listing against the publisher the project names on its own site, and reach the listing through a link on that site rather than through a search result. Review counts and download numbers are weak signals because they can be inflated or inherited. If the app asks for your recovery phrase during a restore, that is normal for a genuine wallet and also exactly what a counterfeit does, so the phrase request alone does not distinguish them.
I typed my seed phrase into a fake wallet. What now?
Treat every key derived from that phrase as exposed. Generate a new wallet on a trusted device and move the assets to it; do not reuse the exposed phrase. Uninstalling the fake app stops it running but does not retrieve the phrase the operator already received, so removal is necessary and not sufficient.
Are browser wallet extensions riskier than mobile apps?
They expose a different surface. An extension runs inside the browser and can read and modify pages, so a counterfeit can replace a pasted address or alter a signing prompt, not only collect a phrase. The download route matters more than the platform: a genuine extension reached through the project's own site is a different proposition from a lookalike reached through a search ad.
Do high download numbers mean a wallet listing is genuine?
No. Download and review counts can be inflated, and a listing can change hands after approval. They are weak signals on their own. The publisher name and the route by which you reached the listing are stronger checks.
Can a fake wallet steal funds without my seed phrase?
Yes, in some designs. A counterfeit extension can replace the address you paste into a send field with one the operator controls, or change what a signing prompt displays so the transaction you approve is not the one you read. That is why the download route matters even for users who never type a phrase into anything.
Read next
- How Wallet Drainers Work Learn how wallet drainers trick users into signing malicious transactions. Understand the mechanism, spot red flags, and prevent crypto theft.
- Two-Factor Authentication for Crypto: Ranking Factors Rank factors by what defeats an attacker: hardware key, then authenticator app, then SMS a long way behind. And where 2FA does nothing at all.
- How Crypto Phishing Works: Attack Vectors and Defenses Learn how crypto phishing attacks operate, from fake wallet sites to malicious airdrops, and how to protect your keys and signatures.
- How to Recover a Crypto Wallet: Seed Phrases and Moving Devices Learn what seed phrase recovery actually restores, what it misses, and how to move wallets safely between devices.
- Smart Contract Wallets: A Wallet That Is a Program Recovery without a seed phrase, spending limits and batched approvals, against deployment cost, per-chain addresses and dependence on the contract's code.