The App Store listing that wasn't real

August 2024. A holder in San Diego searches "Trust Wallet" on the Apple App Store. The top result has the green Trust Wallet shield, 4.8 stars, 8,000 reviews. He installs it, imports his existing seed phrase, and watches his $19,000 in BNB and BSC tokens drain within four minutes.

The listing was a clone whose developer name was a near-miss of the real one — a hyphen here, a missing comma there, close enough that nobody reads it twice. It stayed up for nine days before it was taken down.

Why even the App Store gets fooled

Apple's review process catches most fraud, but lookalike wallet apps slip through periodically. They are designed to pass review (the app appears to work normally for the reviewer) and to drain only when the user imports a real seed phrase with material balance. Once installed, the app uploads the seed to the operator's server, then proceeds as a normal wallet client until the operator gets around to draining.

The four verification steps before installing a wallet app

  • Cross-check the developer name against the wallet's official site. Trust Wallet links to its App Store and Play Store listings directly from trustwallet.com. Click through from the site, not the other way around, and if the developer name on the listing you are about to install does not match the one the site sends you to, do not install it — however close the name looks.
  • Check the review count and the review dates. A real wallet app has reviews going back years, with a steady drip. A clone has 8,000 reviews all dated within the last 60 days — bought in batches.
  • Check the developer's other apps. A clone developer account often carries a scatter of unrelated utility apps, published to make it look like an established company.
  • Use the wallet on a fresh device first. Generate a new seed, fund it with $20, hold it for a day. If anything looks unusual, you have lost $20, not $20,000.

The seed-phrase rule

Never import a high-value seed phrase into a freshly installed app on any platform without first verifying the app over multiple sources. A seed phrase, once entered into a malicious app, is permanently compromised — even after you uninstall the app.

What I do

I keep two seed phrases — one "tier 1" with serious money, never enters any software wallet, only ever signs through hardware. One "tier 2" holding only a small amount, used freely for testing new apps. The two never mix.