The fraudulent app, discovered by cybersecurity firm Check Point Research (CPR), mimicked the legitimate WalletConnect protocol and targeted mobile users.
A fake crypto wallet app, posing as WalletConnect, managed to slip past Google’s defenses and was available on the Play Store for five months. The fraudulent app stole over $70,000 in crypto from users before being taken down.
The scam app was discovered by cybersecurity firm Check Point Research (CPR), which found that it mimicked the legitimate WalletConnect protocol and targeted mobile users. Over 10,000 users downloaded the app, and around 150 reported losing their cryptocurrency.
The scammers took advantage of common challenges faced by Web3 users, such as compatibility problems between cryptocurrency wallets. They promoted the app as a solution to these issues, especially exploiting the absence of an official WalletConnect app on the Play Store. This deception and numerous fake positive reviews made the app appear authentic to unsuspecting users.
Once installed, the app prompted users to link their cryptocurrency wallets under the pretense of offering seamless access to Web3 applications. When users authorized transactions, they were redirected to a malicious website that stole their wallet details, including blockchain addresses. Using these details, the scammers initiated unauthorized transfers, draining funds from the victims’ wallets.
Despite its fraudulent nature, the crypto wallet app remained on the Google Play Store for five months. Its deceptive reviews allowed it to evade detection for an extended period. CPR’s investigation ultimately revealed the scam, estimating that around $70,000 was stolen from the victims’ wallets.
Following the CPR report, Google took down the malicious app and highlighted its Google Play Protect feature, designed to protect Android users from known threats. However, this incident follows similar attacks targeting mobile users, including a previous case where over 11 million Android users unknowingly downloaded apps infected with Necro malware.
Michael McLaughlin, a cybersecurity expert, emphasized the need for users to be cautious when downloading cryptocurrency apps. He advised users to implement multi-factor authentication for added security on cryptocurrency trading platforms. McLaughlin also recommended thoroughly checking app reviews and history for sudden changes before downloading, as scammers often rebrand existing apps to deceive users.
“If you’re using a crypto trading platform—and it could be Coinbase, it could be Kraken, it could be any of those— they offer multi-factor authentication even on their mobile applications. And you have to implement them,” said McLaughlin
