Hijacked Snap Store publisher accounts push fake Exodus, Ledger Live and Trust Wallet apps
Linux users installing wallet apps from the Snap Store
SlowMist reported that attackers re-registered expired domains belonging to established Linux Snap Store publishers, reset the publisher accounts, and pushed updates that turned trusted apps into fake Exodus, Ledger Live and Trust Wallet clients. The fake apps ask for the wallet recovery phrase and send it to the attackers. Linux users who installed wallet apps from the Snap Store should check the publisher and never type a recovery phrase into a desktop app. No loss total was published.
Why this severity: Still active, many people exposed.
- Started
- Jan 21, 2026
- Closed
- Jan 21, 2026
- Chains
- Bitcoin, Multiple EVM chains
Indicators · never visit or send to these
- storewise[.]tech
- vagueentertainment[.]com
What to do now
- If you entered a recovery phrase, make a new wallet on a clean device and move all funds now. Remove the snap and install the wallet from the vendor's official site instead.
Stay safe
Am I affected?
You may be affected if you use Linux and installed or updated an Exodus, Ledger Live or Trust Wallet app from the Snap Store, and it asked for your recovery phrase.
What to do now
If you entered a recovery phrase, make a new wallet on a clean device and move all funds now. Remove the snap and install the wallet from the vendor's official site instead.
How to avoid this
Get wallet software only from the wallet maker's website. Check that the store publisher is the real vendor (verified badge). Treat any desktop app that asks for your recovery phrase as a scam.
Timeline 1
SlowMist's CISO warns that Snap Store publisher accounts tied to expired domains are being taken over to ship fake wallet apps.
Source
News & write-ups ›1
How this method works
Look-alike apps on app stores or download sites that steal your seed phrase or show a fake balance while keeping your deposits. Read about fake wallet and trading apps →
Follow new drains and updates in your feed reader or Telegram RSS bot.