Theft & hacks

Fake wallet apps and clone sites: how to spot them and what to do after a theft

A copy of MetaMask in the browser extension store, a “Trust Wallet” app with a slightly different developer name, a sponsored search result that leads to a perfect clone of a wallet’s website, a pop-up asking you to “sync” or “validate” your wallet. They all aim at one thing: your seed phrase, or a wallet whose seed phrase the attacker already knows. This guide shows how fakes are distributed, the signs that give them away, and what to do if one has already emptied your wallet.

Updated 17 October 2026 · about 9 minutes to read

The forms a fake takes

• Clone apps in official stores. Fakes regularly get through review in mobile app stores and browser extension stores, sometimes for days or weeks. They copy the icon, the name and screenshots; the difference is in the developer name, the publication date and the details.
• Sponsored search results. A paid ad above the real result leads to a copy of a wallet’s website with a download button. The domain differs by a letter, a hyphen or an extra word.
• “Sync”, “validate” or “restore” pages. A page, often linked from a fake support account or a direct message, asks you to enter the seed phrase to fix a problem, claim an airdrop or avoid a “wallet suspension”. Real wallets never ask for that.
• Pre-generated seed phrases. A fake app creates a “new wallet” for you, but the seed phrase was generated by the attacker, who simply waits until you deposit enough.
• Fake updates. A pop-up on a website or in a cracked program says your wallet needs an update and installs malware instead.
• Tampered hardware wallets. A device bought from an unofficial seller, sometimes with a card in the box showing a ready-made seed phrase. A genuine device never comes with a seed phrase; you create it yourself on the device.

How to tell a fake

No single sign is proof, but together they are reliable:

• The link did not come from the official website. Open the wallet’s official site by typing the address you already know, and follow the store link from there. Do not start from a search ad or a message.
• The developer or publisher name is different from the one listed on the official website, even by a word.
• The app or extension is new, has few downloads compared with the real one, or its reviews look generic, repetitive or all from the same days.
• It asks for your seed phrase when you did not choose to restore a wallet. Any request to “confirm”, “verify” or “sync” with a seed phrase is a theft attempt.
• It shows you a seed phrase without letting you create one, or the phrase appears before you have done anything, or the app sends it anywhere.
• The domain is close but not exact: extra letters, a different ending, a hyphen, or characters from another alphabet that look the same.
• Urgency and support in direct messages. Real wallet projects do not write to you first and do not do support through private chats.

Installing a wallet safely

1. Start from the wallet’s official website, typed by hand or from a bookmark you created earlier.
2. Follow the store link on that site and check that the developer name matches.
3. Create a new wallet yourself and write the seed phrase on paper. If the app offers a seed phrase without you starting the process, or one came printed with the device, do not use it.
4. Send a small test amount and confirm you can send it back out before depositing anything significant.
5. Bookmark the official site. Never reach it through search ads again.

If a fake app has already taken the funds

Act in this order; the details are in what to do when your wallet is emptied:

1. Treat the seed phrase as known to the attacker. Every address and every network derived from that phrase is compromised, including wallets in other apps where you imported the same phrase.
2. Move what is left to a new wallet created on a clean device, from the official app, with a new seed phrase. Highest value first.
3. Remove the fake app or extension, and if you installed anything outside the official stores, assume the device itself is infected and reinstall the system before creating a new wallet on it.
4. Record the evidence: the app’s name, developer name, store link and package or extension ID; the site’s full address; screenshots; the date you installed it; the transaction hashes of the theft and the receiving addresses.
5. Follow the money one or two hops in a block explorer and look for a regulated exchange or a stablecoin issuer. If you find one, send a freeze request the same day — see the first 48 hours and our free templates.
6. File a police report with a reference number: how to report crypto theft.

Reporting the app or site

Reporting does not return funds, but it takes the fake down faster and creates records that investigators and platforms can use:

• The app store or extension store — every store has a “report” option on the listing. Mention that it impersonates a named wallet and steals seed phrases.
• The real wallet project through the support or abuse channel listed on its official website. Projects track clones and sometimes have more information about a campaign.
• The search engine, if you arrived through an ad: report the ad and the phishing page.
• The domain registrar and hosting provider of the clone site, through their abuse address.
• Your police report, with all of the above attached.

Asking the store for a refund does not cover crypto: a free app was “bought” for nothing, and the theft happened on the blockchain. If you paid for anything by card on the fake site, that payment is a separate question for your bank — see getting money back through your bank.

What is realistic

A blockchain transfer cannot be reversed. What can still help happens where the money arrives: a regulated exchange that can freeze a deposit, a stablecoin issuer that can block an address when authorities require it. If the funds went to addresses nobody controls or through mixers, tracing produces a document, not a return, and anyone who tells you otherwise is selling hope. Fake “wallet recovery” services and apps are also common after this kind of theft — read the warning signs before replying to anyone who contacts you. A similar theft by a substituted address is described in theft by address substitution.

If the trail reaches a platform you can name, describe the situation — we will tell you free of charge whether there is a realistic legal route and what to send now.