Fake Wallet Scams 2026: Apps, Extensions and Drainers

Last updated: October 2026

A fake wallet scam is any attack that gets you to hand over your seed phrase or sign a malicious approval by imitating a wallet you trust. It can be a cloned app in an official store, a fake or hijacked browser extension, a drainer site that connects to your real wallet, a "support agent" in your DMs, or a lookalike address planted in your history. None of these need to break any cryptography. Each one waits for you to do something that looks normal at the wrong moment.

This guide covers the five variants doing the damage in 2026, the real cases from the past year, how to check a wallet before you install it, and what to do in the first hour if you have been hit.

Fake wallet scams in 2026: what actually happened

The past twelve months showed that "only install from the official store" is no longer enough on its own. Cloned and compromised wallets reached users through Apple's App Store, the Chrome Web Store and a genuine wallet's own update channel.

On the signing side, Scam Sniffer counted $83.85 million lost to wallet-drainer phishing in 2025 across about 106,000 victims. That is down 83% on 2024, but the average loss is smaller and the number of attacks is still high. Permit signatures accounted for 38% of losses in cases over $1 million (Scam Sniffer, 3 Jan 2026). For the full scam landscape, including pig butchering and impersonation, see crypto scams in 2026.

1. Cloned mobile apps

An app in an official store uses the real wallet's name and icon, and sometimes has hundreds of reviews. On first launch it asks you to "import your existing wallet", and the seed phrase goes straight to the attacker.

The 2026 cases added two twists:

• Disguised listings. In the campaign Kaspersky found, the App Store listings looked like games, calculators or to-do apps. Once opened, they sent users to a fake App Store page and talked them into installing a developer profile. That profile let a trojanised wallet install outside Apple's review process.
• Brands with no iOS app. The real Sparrow Wallet does not exist on iOS, so anyone searching the App Store found only the fake. If a wallet you know from desktop "shows up" on mobile, first check that the project actually ships a mobile app.

Signals: a recent publish date on an established brand, a developer name that is not the real company, generic reviews bunched on the same dates, a download count far below what the brand should have, and any request to install a profile or "update" from outside the store.

Rule: get the store link from the wallet's official website, not from search. Store search results can be bought and gamed.

2. Cloned and hijacked browser extensions

This works the same way in extension stores, and it is harder to spot because extension listings carry less signal. Some clones work normally for days before stealing keys, so "it worked fine" proves nothing.

Signals: a publisher name that does not match, a permissions list broader than the real extension needs, and a store URL that differs from the one linked on the official site.

When the real extension turns bad

Two 2026 patterns get past the usual checks, because the publisher name and store listing are genuine:

• Bought extensions. Attackers buy a popular, harmless extension and push a malicious update through the store's normal update channel. In Socket's August 2026 batch, five of the 19 extensions had been bought from their original developers. The extensions could drain wallets and record credentials typed on other websites.
• Compromised publisher keys. The Trust Wallet v2.68 update was published with a leaked Chrome Web Store API key. Users who unlocked the extension between 24 and 26 December 2025 had their seed phrases sent to the attacker. Trust Wallet's fix was version 2.69, plus moving funds to new wallets.

What helps: keep very few extensions in the browser profile that holds your wallet, use a separate browser profile just for crypto, and keep significant funds in a hardware wallet or multisig, where an extension update alone cannot sign. If a wallet maker announces a compromised version, follow only its official channels. Fake "affected user" refund forms follow these incidents quickly.

3. Drainer sites

No fake app at all. A website (an airdrop claim, a mint, a "migration" page) connects to your real wallet and asks you to sign. The signature is not a transfer. It is an approval that lets a contract move your tokens, or a batched permit that does the same across several assets at once.

Your seed was never involved. One signature was enough.

Signals: urgency ("claim within 24 hours"), a request to sign something your wallet cannot decode, an approval for an unlimited amount, and a domain that is one character off the real one.

Mechanics in detail: wallet drainers and approval phishing.

4. Fake support

You post a problem in a public channel. Within minutes, someone helpful sends you a DM. They are attentive and know the technical details, and eventually they send you to a "validation" page or ask you to share your screen.

This is the wallet-level version of the trend Chainalysis flagged across all crypto fraud: impersonation scams grew 1,400% year on year in 2025 (Chainalysis, 13 Jan 2026).

Rule: real support never starts the DM, and never needs your seed phrase or remote access. Anyone who does either is an attacker, without exception.

5. Address poisoning

The attacker sends you a dust transaction from an address generated to match the first and last characters of one you use regularly. Later you copy the address from your history and pick the wrong one.

This is not theoretical. The two losses above came to $62.2 million, and Coin Metrics estimates that stablecoin dust makes up about 11% of all Ethereum transactions on an average day, consistent with mass poisoning (Cointelegraph, 9 Feb 2026). Generating lookalike addresses that match both ends of a target is cheap and done at scale.

Rule: never copy an address from transaction history. Use a saved contact, check the middle characters rather than just the ends, and send a small test transaction before a large one.

How to verify a wallet before you install it

Every one of the cases above would have been stopped at one of these steps:

1. Start from the official website, typed by hand or from your own bookmark. Not from an ad, a search result, a social post or a link someone sent you.
2. Confirm the platform exists. Check the official site's download page to see whether the project actually publishes a mobile app, an extension, or both. If the site does not list it, any store listing under that name is fake.
3. Follow the store link from the official site and compare the publisher or developer name exactly.
4. Check the details: install count in line with the brand's size, a long release history, and permissions that match what a wallet needs.
5. Never install a profile, certificate or "update" from outside the store. On iOS, a request to install a developer or configuration profile for a wallet is a red flag on its own.
6. Create a new wallet first and test with a small amount. A legitimate wallet never needs your existing seed to "verify", "sync" or "activate".
7. For hardware wallets, buy only from the manufacturer or an authorised reseller, and set up the seed yourself on the device. A device that arrives with a pre-printed recovery phrase is compromised.

Once installed, the main difference is what can sign. A hot wallet vs a cold wallet explains where each belongs, and our non-custodial wallet entry explains why self-custody puts this job on you.

What you are actually signing when a drainer succeeds

Almost every drain comes down to an approval the user granted on purpose, believing it was something else. Knowing the four signature types makes the danger clear at the moment it matters.

• Token approvals. These give a contract permission to move a token on your behalf, often for an unlimited amount. The permission lasts until revoked, which is why a site you visited once can drain your wallet months later.
• NFT collection approvals. A single approval covers an entire collection rather than one item. Every legitimate marketplace asks for one, which is exactly why it does not look alarming.
• Off-chain permit signatures. A gasless signature that grants spending rights. It costs nothing, creates no pending transaction, and looks harmless because no gas is involved. That makes it the most dangerous type.
• Blind signatures. A raw hash with no human-readable decoding. If your wallet cannot tell you what a signature does, you cannot meaningfully agree to it.

The key pattern: a transfer moves funds once, while an approval grants standing permission. Drainers almost always want the second.

The five-second check before any signature

1. Does the wallet show what the transaction does? If it shows an undecodable blob, stop.
2. Is it an approval? If so, for what amount? Unlimited is almost never necessary.
3. Which contract is being approved? Does it match the site you are on?
4. Did you start this, or did something prompt you? Unprompted urgency is the giveaway.
5. Could you survive losing this wallet's full balance? If not, don't sign from it. Use a burner.

Revoking approvals properly

Revoking is a transaction, so it costs gas, and you have to do it for each token on the chain where you granted the approval. Revoking on one network does nothing for the same wallet's exposure on another.

A sensible routine: review approvals quarterly, straight after using an unfamiliar contract, and straight away if you suspect a bad signature. Revoke unlimited approvals on anything you no longer use, and set a fixed allowance where the interface lets you.

If you already signed or entered your seed

First work out which situation you are in, because they need different responses:

Then move quickly, in this order:

1. Move remaining assets out first. Don't revoke first. Revoking is a transaction that takes time, and drainers often run bots watching for exactly that.
2. Send to a fresh wallet created on a clean device, not one you have connected to anything.
3. Then revoke approvals on the compromised address.
4. Treat the compromised wallet as permanently burned. If the seed was exposed, it stays exposed. A leaked private key cannot be made secret again. Never reuse it, even after revoking.
5. Record and report. Save transaction hashes, addresses, URLs and screenshots, and report to your national fraud authority (in the US, IC3). If the wallet maker announces an incident and a reimbursement process, as Trust Wallet did for v2.68, use only the form linked from its official site.
6. Do not pay a recovery service. Almost all are second-stage scams. See crypto recovery scams.

The second wave: recovery scams

Reporting a loss publicly marks you as a target for follow-on fraud. Within hours of a visible drain, victims are approached by accounts offering blockchain forensics, "whitehat" recovery, or a fixer with exchange contacts.

The giveaways are consistent: an upfront fee, a request for your seed phrase to "trace" funds, a guarantee of recovery, or a demand for a small "gas deposit" to release a larger sum. No legitimate service asks for a seed phrase, and none can reverse a settled on-chain transfer. The ledger has no undo.

Reducing the blast radius

The structural fix is not vigilance. It is splitting your funds. With separate cold storage, a small hot wallet and a burner for anything unfamiliar, one bad signature can only cost a limited amount.

Setup guidance is in best self-custody wallets and the self-custody guide. The broader scam landscape is in crypto scams in 2026. If you are moving off an exchange after a closure, crypto exchanges shutting down covers doing that safely. That is exactly the moment people search for a new wallet in a hurry.

Frequently asked questions

How can I tell a fake wallet app from the real one?

Install only from the link on the project's own verified site rather than searching the app store, where cloned listings with plausible review counts are routine. Check the developer name against the official one, and treat any wallet that asks you to import a seed phrase on first launch to “verify” or “sync” as hostile. Legitimate wallets never require this to open.

Can fake wallet apps really get into the official App Store?

Yes. In April 2026 Kaspersky reported 26 phishing apps in Apple's App Store impersonating major wallets, and in July 2026 three users sued Apple over a fake Sparrow Wallet app they say cost them about $1.8 million. Being in an official store is not proof a wallet is genuine.

Is a signature request safe if it does not cost gas?

No, and that misconception is behind many large losses. Off-chain permit signatures are gasless and grant spending rights immediately. The absence of a gas fee means no transaction is pending, not that nothing was authorised.

What should I do the moment I realise I signed something malicious?

Move remaining assets to a fresh wallet first if the drain is still in progress, because attackers can front-run the revocation itself. Then revoke the approval on the chain where you granted it. Then stop using the compromised wallet for anything of value. A wallet that has signed a malicious approval should be considered permanently untrusted.

Can drained funds be recovered?

Almost never. Settled transfers are final, and no service can reverse them. If funds reach a centralised exchange, a law-enforcement report can sometimes lead to a freeze. That depends on the exchange and the jurisdiction, and no paid recovery service can promise or deliver it.

Does a hardware wallet prevent this?

It prevents key extraction, not bad approvals. If you approve a malicious contract on a hardware wallet, the drain proceeds exactly the same way, because the signature was valid and you provided it. Hardware helps because it forces you to confirm on a separate screen, which only protects you if you read what that screen says.

What is address poisoning?

An attacker sends a zero-value transfer from an address whose first and last characters match one you have used, so it appears in your history. Later you copy the address from that history and send funds to the attacker. The defence is never copying from transaction history. Use a saved address book and check the middle characters, not just the ends.