A fake crypto wallet is an app, browser extension, website or device built to look like a real wallet such as MetaMask, Trust Wallet, Exodus or Ledger, but designed to capture your recovery phrase or trick you into sending funds. Once the attacker has your seed phrase, they can empty the wallet from anywhere, and blockchain transfers cannot be reversed. These fakes reach people through app stores, search ads, lookalike domains and even the post. The good news is that they follow a small number of repeatable patterns, and a one-minute check before installing anything defeats most of them.
Key takeaways
- Fake wallets almost always aim for one thing: your 12- or 24-word recovery phrase.
- They spread through official app stores, browser add-on stores, paid search ads, typo domains and tampered hardware.
- Reach a wallet by typing its official domain yourself, then follow its own link to the store listing.
- No real wallet, exchange or support agent will ever ask you to “validate” or “sync” your seed phrase on a website.
- If you entered your seed into a fake, move whatever is left to a brand-new wallet immediately, then report it.
Fake crypto site checker
Compares a link against the official domains of major wallets, exchanges and DeFi apps, and flags lookalikes. The check runs in your browser; the address is not sent anywhere.
A match only means the domain is the official one; it cannot detect a hacked site or a malicious transaction. Our list covers major apps and is not exhaustive.
How fake crypto wallet apps steal funds
A wallet does not hold coins; it holds keys. Anyone who learns your recovery phrase can recreate your wallet on their own device and sign transfers. That makes a fake crypto wallet a phishing tool with a convenient disguise. The tricks vary, but they reduce to three mechanisms:
- Seed capture. The fake asks you to “import” or “restore” an existing wallet and sends the words to the attacker. This is the most common method by far.
- Pre-generated seeds. The app creates a wallet for you, but the attacker already knows the seed. It works fine until you deposit a meaningful amount, then it is drained.
- Malicious approvals (drainers). Instead of stealing keys, a fake site or extension prompts you to sign a token approval or “permit” that lets the attacker move your tokens. Wallet drainers are often sold as kits to other criminals.
Some fakes also swap the destination address when you copy and paste, so funds go to the attacker instead of where you intended. Our broader guide to crypto scams covers investment and romance scams; this page sticks to counterfeit wallets.
Six fake-wallet patterns to recognise
1. Clones in official app stores
Being in an official store is not proof of legitimacy. In late 2023, an app called “Ledger Live Web3” sat in the Microsoft Store from 19 October until it was removed after investigator ZachXBT flagged it on 5 November; losses tied to it were reported at about $768,000. Warning signs included a generic developer name, a single review and a description copied from the real listing.
2. Fake browser extensions (fake MetaMask extension, Rabby, Exodus)
Fake extensions copy names, icons and screenshots. In August 2025, researchers at Koi Security described a campaign dubbed GreedyBear that had placed more than 150 malicious Firefox add-ons imitating MetaMask, TronLink, Exodus, Rabby and others, linked to around $1 million in thefts. The publishers uploaded harmless versions first, collected positive reviews, then swapped in code that captured what users typed. High ratings do not prove an extension is real.
3. Paid search ads and lookalike domains
Typing “MetaMask download” or “Exodus wallet” into a search engine can return ads that point to copies. Lookalike addresses follow recognisable patterns: the brand misspelled by a letter or two, the brand plus words like “extension”, “app” or “us”, or an unusual country-code ending. Phishing pages are built to rank for exactly the searches people type, sometimes with the brand name and a strange domain in the same query. The real wallet’s site is never “the first ad”.
4. Fake Trust Wallet and other “support” accounts
Scammers answer complaints on social media, Telegram and Discord posing as wallet support, then send a link to “fix” or “sync” the wallet. A fake Trust Wallet support agent is one of the most common versions. Real support teams do not DM first and never need your seed.
5. “Wallet validation” and airdrop sites
Pages claiming your wallet must be “validated”, “rectified” or “whitelisted” for an airdrop ask you to type in your recovery phrase or connect and sign. Either step can hand over control.
6. Compromised genuine software
Not every threat is a counterfeit. In December 2025, a malicious update to Trust Wallet’s genuine Chrome extension, version 2.68, captured passwords and seed data from users who unlocked it; Trust Wallet told users to upgrade to 2.69 and announced reimbursements, with losses reported at roughly $6–7 million. Keep software updated, watch the wallet’s official channels, and keep large holdings off browser extensions entirely.
How to verify a real wallet download
This 60-second checklist works for any wallet app or extension:
- Start from the official domain, typed by hand. Get it from a source you already trust (the project’s verified social account, your existing bookmark, or a well-known reference). Use the download link on that site rather than searching a store.
- Check the developer name. On the store listing, the publisher should match the company (for example, MetaMask is published by Consensys). “Official Dev” or a personal name is a red flag.
- Look at install counts and history. Genuine popular wallets have large install bases and long histories. A “MetaMask” with a few thousand installs and recent reviews is not MetaMask.
- Read the permissions and reviews, newest first. Recent one-star reviews mentioning lost funds are the strongest signal of all.
- For desktop apps, verify the file. Many wallets (Exodus, Sparrow, Electrum, Trezor Suite and others) publish checksums or PGP signatures. Compare the hash of your download with the one on the official site.
- Never import an existing seed to test an app. If you must try a new wallet, create a fresh one and send a small amount.
| Check | Genuine wallet | Common fake |
|---|---|---|
| How you found it | Typed domain or saved bookmark | Search ad, DM, email or QR letter |
| Publisher name | Matches the company | Generic, misspelled or unrelated |
| Install count and age | Large and long-standing | Small, recent, sudden burst of reviews |
| First screen | Offers to create a wallet; import is optional | Pushes you straight to “import” or “restore” |
| Seed handling | Seed shown once for you to write down | Asks you to type your seed for “verification” |
If you are still choosing a wallet, our list of the best crypto wallets for beginners lists established options; still reach each one through its typed domain.
Fake hardware wallets and tampered devices
Hardware wallets are a target precisely because people trust them. After a 2020 breach of Ledger’s customer database exposed buyers’ names and addresses, some customers later reported receiving tampered “replacement” devices and letters by post. Since April 2025, posted letters on Ledger branding have told owners to scan a QR code for a “security update” or “transaction check” and then type their recovery phrase into a fake site; Ledger has said these letters are scams, and similar letters targeting Trezor owners followed. The patterns:
- A device bought from a marketplace seller at a discount, arriving with a recovery sheet already filled in.
- An unsolicited “replacement” device or a letter warning that your device must be updated via a QR code.
- Packaging with broken seals or a device that does not ask you to set it up from scratch.
A genuine hardware wallet always generates a new recovery phrase on its own screen during setup. Buy from the manufacturer or its listed resellers, run the device’s built-in authenticity check where it offers one, and ignore any mail you did not request.
Already installed a fake wallet? Do this
Speed matters, because attackers often run automated sweeps.
- Assume the seed is compromised. If you typed it into anything suspicious, it is no longer secret.
- Create a brand-new wallet on a trusted device and move any remaining funds there. Do not reuse the old seed.
- Revoke token approvals on the old address if you signed anything; our guide on how to revoke token approvals walks through it.
- Uninstall the fake, run a malware scan, and change passwords used on that device.
- Report it. In the US, file with the FBI’s Internet Crime Complaint Center (IC3) and the Federal Trade Commission (FTC). Report the listing to the store (Google Play, Apple App Store, Chrome Web Store or Firefox Add-ons) and notify the real wallet company. Note transaction hashes and the attacker’s address.
- Ignore “recovery” offers. People who contact you promising to get the crypto back for an upfront fee are usually running a second scam. Read our crypto scam recovery guide before talking to anyone.
For layered protection beyond this checklist, see the security section of our crypto wallets and security hub, which covers scams and recovery in more depth.
FAQ
How can I tell if my MetaMask extension is fake?
Open your browser’s extension manager and check the publisher: the genuine MetaMask is published by Consensys and has millions of users. Then confirm you installed it from the link on the official MetaMask site. If the extension asked you to import a seed straight away, has few users or reviews mentioning lost funds, remove it and move your funds to a new wallet created in the genuine extension.
Is there a fake Trust Wallet app?
Copies of popular wallets, including Trust Wallet, regularly appear on unofficial download sites, in search ads and occasionally in app stores, alongside fake support accounts on social media. Download only through the link on the official Trust Wallet website, check the publisher name in the store, and never share your recovery phrase with anyone claiming to be support.
What is a wallet drainer?
A wallet drainer is malicious code, usually on a phishing website, that asks you to connect your wallet and sign approvals or permits. Those signatures let the attacker transfer your tokens without ever knowing your seed. Read every signing request, be wary of “claim” or “mint” pages reached via ads or DMs, and revoke approvals you no longer need.
Can I get crypto back from a fake wallet?
Usually not. Blockchain transfers are final, and funds stolen through fake wallets are often moved quickly through other addresses. Reporting to IC3, the FTC and the exchange that receives the funds can help investigators, and exchanges sometimes freeze stolen assets. Treat anyone guaranteeing recovery for a fee as a likely scammer.
Crypto is volatile and risky; this is education, not financial advice. Do your own research.
