A malicious crypto wallet app posing as the popular Web3 protocol WalletConnect was downloaded 10,000 times on Google Play Store before being removed. The app managed to siphon over $70,000 worth of cryptocurrency in just four months.
10,000 Users Downloaded the Fake Crypto Wallet, But Only 150 Were Affected
According to official reports, while 10,000 people downloaded the fake app, only 150 users had their assets stolen. Despite this, the incident highlights ongoing security vulnerabilities in mobile app markets.
Cybersecurity firm Checkpoint Research revealed that the app lured users into confirming transactions on a phishing website, giving hackers access to their digital wallets. In contrast, the legitimate WalletConnect protocol uses QR codes to securely facilitate communication between crypto wallets and decentralized applications (dApps), allowing users to interact with dApps without exposing their private keys.
Cybersecurity Experts Warn Crypto Users
Michael McLaughlin, co-leader of the Cybersecurity and Data Privacy Practice Group at Buchanan Ingersoll & Rooney, emphasized the importance of basic cybersecurity measures for crypto users. “If you’re using Coinbase, Kraken, or any other crypto trading platform, they offer two-factor authentication even on mobile apps. You have to use it,” he said.
McLaughlin also urged users to be cautious when downloading apps from digital stores, advising them to thoroughly review app ratings and comments. “If it only has three users and no stars, you’re not going to trust it,” McLaughlin added. He further warned about sudden changes in app behavior, like legitimate-looking apps suddenly shifting to crypto trading overnight.
