How to spot a fake wallet app before it costs you
Counterfeit wallet apps and sites exist to capture a seed phrase or swap a deposit address. The signals that give them away, and the habits that make it moot.
Fake wallets are one of the most effective attacks in crypto because they do not need to break anything. They just need you to type a seed phrase into the wrong box, or send to an address that was never yours.
Signals in an app listing
Recent publish date on an app claiming to be an established brand. Real wallets have years of version history.
A developer name that is not the company. Check it against the name on the official site, not against how plausible it looks.
Review patterns that do not fit: a few thousand five-star reviews all written in the same week, alongside a handful of one-star reviews saying funds disappeared. Read the one-stars first.
Permissions that make no sense for a wallet, like reading your SMS or your contacts.
Signals on a website
A domain that is nearly right. Swapped letters, an extra word, a different ending. Search ads are routinely bought on brand names by people running these, so the first result is not automatically the real one.
No padlock, or a certificate issued to a different name than the site claims.
Any prompt — anywhere, under any framing — to enter a seed phrase to connect, verify, validate, migrate or unlock. No legitimate service needs it. This single rule catches most of these attacks on its own.
Habits that make the question irrelevant
Reach the site by typing the domain yourself or from your own bookmark, never from a search ad, a message or an email link.
Install apps only from a link on the official site, so the site vouches for the listing rather than the listing vouching for itself.
Check a deposit address inside the app against the same address shown after a fresh sign-in on another device, if the amount is large. A swapped address is the other half of this attack.
BYCRYPTO's Android app is only published from bycrypto.shop. If you find it anywhere else, that copy is not ours.