Security researchers from Cyble have uncovered a series of fraudulent cryptocurrency wallet apps on the Google Play Store that mimic popular services to steal users’ funds.
More than 20 fake apps impersonate legitimate wallets such as PancakeSwap, Suiet Wallet, Hyperliquid, Raydium, SushiSwap, and others. These malicious apps prompt users to enter their mnemonic phrases through phishing sites or embedded web views, allowing attackers to drain their wallets.
The fake apps are distributed via compromised or repurposed developer accounts, previously associated with legitimate apps. They share common traits, including embedded command and control URLs in their privacy policies, similar package names, and descriptions.
Cyble advises users to check if any of the following wallet apps are installed on their devices and delete them immediately:
- Pancake Swap
- Suiet Wallet
- Hyperliquid
- Raydium
- BullX Crypto
- OpenOcean Exchange
- Meteora Exchange
- SushiSwap
- Harvest Finance Blog
These apps have been gradually discovered over recent weeks and reported to Google, resulting in removals from the Play Store. However, the campaign continues to evolve, making vigilance essential.
Users should only install wallet apps directly from official sources linked on the legitimate wallet websites and ensure Google Play Protect is enabled for added security.
Because digital wallet losses are typically unrecoverable, users must exercise caution when managing crypto apps on their devices.