TL;DR
Fake wallet apps and sites look exactly like the real thing and want one of two things: your seed words, or to show you an address that isn’t yours. Type the maker’s address yourself, verify downloads, update only inside the official app, and never enter seed words anywhere except on the hardware wallet itself.
Every wallet I use in this setup has been copied by scammers at some point: fake download sites, fake apps in official app stores, fake support and fake security emails. They work because they look real, and some of them really do come from the real sender’s domain. Here’s how they reach people, and the habits that make them harmless.
How the fakes reach you
Search ads and lookalike sites
Scammers buy ads on wallet names, so the first result for “Sparrow wallet download” can be a copy of the real site with a changed installer. Lookalike domains add a word, change the ending, or swap a letter. A fake Sparrow would show you addresses that belong to somebody else, which is why step 3 has you type the address yourself and check the signature.
Fake apps in official app stores
An app store listing isn’t proof. Two cases from this year:
- Fake Sparrow on the iPhone. Sparrow is desktop software for Windows, macOS and Linux, with no phone app. Still, a fake “Sparrow Wallet” on Apple’s App Store asked users for their seed words. In July 2026 three victims sued Apple over losses of about $1.8 million.
- Fake Ledger Live on the Mac. In April 2026 a fake Ledger app on the Mac App Store was linked to about $9.5 million in losses from some 50 victims, again by asking for seed words. Ledger’s Mac app comes from Ledger’s own website, not the Mac App Store.
Fake support
You post about a problem and a “support agent” messages you, or a search ad leads to a fake help desk with a phone number. Electrum’s own site says anyone offering help through a private channel is probably an imposter. BitBox says it doesn’t provide wallet-security support by phone. Real support never needs your seed words: that’s always a scam.
Fake security alerts and firmware emails
On September 9, 2026, Trezor said attackers had abused its email provider to send a “Critical Security Alert” from Trezor’s real domain. BitBox reported the same kind of attack, through its newsletter provider, around the same time, with a fake “Microcontroller Entropy” warning that led to a site asking for recovery words. The lesson: a genuine sender address proves nothing. Firmware updates come through the maker’s app, never through a link in an email (firmware updates).
Letters and packages
Ledger’s 2020 customer data leak put names and postal addresses in scammers’ hands. In December 2020 a file with those customer details was posted publicly; Ledger said the leak covered about 1 million email addresses and 9,500 records with names, postal addresses and phone numbers. Since then people have received letters, and even replacement devices, telling them their wallet was unsafe. BitBox warns about a postal letter with a QR code and a deadline for a “Quantum Resistance” update. Don’t scan it. Nothing that arrives unasked is a real update.
The official addresses
Checked October 10, 2026. Type these yourself, then bookmark them, and use the bookmark from then on.
| Software | Official site | Good to know |
|---|---|---|
| Sparrow | sparrowwallet.com | Desktop only. Any Sparrow phone app is fake. |
| Electrum | electrum.org | Desktop, plus Android through Google Play, F-Droid or an APK from the site. No iPhone app. |
| Trezor Suite | trezor.io | Desktop app from trezor.io. The phone app is linked from trezor.io to Google Play and the App Store. |
| BitBoxApp | bitbox.swiss | Download page bitbox.swiss/download. Shop and support also live under bitbox.swiss. |
| Ledger Wallet (formerly Ledger Live) | ledger.com | Desktop downloads come from Ledger’s own site. Support: support.ledger.com. |
For a phone app, start from the maker’s website and follow its link to the store, rather than searching the store. Then check that the publisher name matches the maker.
How to stay safe
- Type the address yourself or use your own bookmark. Never click an ad for wallet software.
- Verify every download you can. For Sparrow the full check is in step 3; later versions you check with Tools → Verify Download. Electrum publishes signatures too.
- Update firmware only from inside Trezor Suite, the BitBoxApp or Ledger Wallet, after you opened the app yourself.
- Ignore every unsolicited email, text, call, letter or package about your wallet, however official. If you want to check, type the maker’s address yourself.
- Seed words go into the hardware wallet itself, during a recovery you started. Never into a website, an app, a form or a chat.
- Contact support only through the support page on the maker’s own domain.
Why a multisig limits the damage
A fake app can only steal what you give it. If you type one seed into a fake site, the thief has one key out of three, and in a 2-of-3 that can’t spend anything. A fake Sparrow that shows a false address is caught when you check it on a device that has your multisig registered, as in step 8. Neither makes it safe to relax: one exposed key means your safety margin is gone.
Already entered seed words or installed a fake?
- Stop using that computer or phone for anything to do with bitcoin.
- Treat the seed you entered as known to others and replace that key: a seed backup was seen or taken shows how to move to a new multisig.
- Installed a fake desktop wallet on your signing computer? Follow signing laptop broken or infected.
- Ignore anyone who then offers to recover your funds. That’s the next scam.
Common mistakes
- Trusting a result because it was at the top of the search page.
- Trusting an app because it’s in the official app store.
- Trusting an email because the sender address looks right.
- Clicking “update” in an email instead of opening the maker’s app.