Warning: Fake Crypto Wallet Apps on Google Play Are Stealing Private Keys!

Even if you download applications exclusively from Google Play, this does not always guarantee safety—particularly when it comes to cryptocurrency wallets. Researchers at Cyble Research and Intelligence Labs (CRIL) have uncovered over 20 malicious Android applications that masquerade as popular wallet apps, stealthily exfiltrating the private keys to users’ digital assets.

These counterfeit apps mimic the names, icons, and interfaces of renowned services such as SushiSwap, PancakeSwap, Hyperliquid, Raydium, and others. Once installed, they prompt users to input their mnemonic phrase—the twelve-word “vault key” required to restore wallet access. Entering it leads to an immediate theft of funds by malicious actors.

These applications are not spread haphazardly, but through compromised or repurposed developer accounts that previously published legitimate software—games, video platforms, and streaming services. Some of the fake apps remain available on Google Play, while others were removed following researchers’ reports. Nonetheless, the campaign continues.

The malware strains share telltale signs: phishing domains embedded within privacy policies, identical naming schemes for app packages, and reliance on the same development framework—Median—which swiftly converts websites into APK files.

Below is a list of the identified malicious applications:

Additionally, two more apps were found employing alternate tactics, though with the same malicious intent of key theft:

Some of the malware opens phishing websites within embedded WebView components, while others utilize compiled modules to load deceptive interfaces. All lead to websites meticulously designed to mirror legitimate wallets but are, in fact, traps. Researchers discovered that these apps are tied to a shared infrastructure involving over 50 phishing domains hosted on a single IP address.

This attack is particularly insidious due to its sophisticated disguise as authentic products and its use of previously reputable developer accounts. For cryptocurrency users, the consequences can be catastrophic and irreversible—unlike traditional banking systems, there is no recourse for reversing transactions or retrieving stolen funds.

To protect yourself, download wallet apps only from links provided on the official project website. Examine your device for any apps from the above list, and enable Google Play Protect, which may help detect and block suspicious installations early.

In the era of digital assets, a single careless tap may cost you your entire wallet.