{
 "slug": "snap-store-fake-wallet-updates-expired-domains-jan-2026",
 "title": "Hijacked Snap Store publisher accounts push fake Exodus, Ledger Live and Trust Wallet apps",
 "url": "https://drains.watch/i/snap-store-fake-wallet-updates-expired-domains-jan-2026",
 "json": "https://drains.watch/i/snap-store-fake-wallet-updates-expired-domains-jan-2026.json",
 "status": "closed",
 "severity": "high",
 "threatStatus": "active",
 "verification": "verified",
 "chains": [
  "bitcoin",
  "multi-evm"
 ],
 "method": "fake-app",
 "product": "Linux users installing wallet apps from the Snap Store",
 "tags": [
  "bitcoin",
  "multi-evm",
  "fake-app",
  "linux",
  "snap-store",
  "snapcraft",
  "exodus",
  "ledger",
  "trust-wallet",
  "slowmist",
  "seed-phrase",
  "expired-domain",
  "account-takeover"
 ],
 "amountUsd": null,
 "victims": null,
 "startedAt": "2026-01-21",
 "closedAt": "2026-01-21",
 "updatedAt": "2026-01-21T12:00:00Z",
 "summary": "SlowMist reported that attackers re-registered expired domains belonging to established Linux Snap Store publishers, reset the publisher accounts, and pushed updates that turned trusted apps into fake Exodus, Ledger Live and Trust Wallet clients. The fake apps ask for the wallet recovery phrase and send it to the attackers. Linux users who installed wallet apps from the Snap Store should check the publisher and never type a recovery phrase into a desktop app. No loss total was published.",
 "timeline": [
  {
   "date": "2026-01-21",
   "title": "SlowMist's CISO warns that Snap Store publisher accounts tied to expired domains are being taken over to ship fake wallet apps.",
   "sourceUrl": "https://cointelegraph.com/news/slowmist-linux-snap-store-crypto-seed-attack"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "SlowMist flags Linux Snap Store attack targeting crypto seed phrases",
   "url": "https://cointelegraph.com/news/slowmist-linux-snap-store-crypto-seed-attack",
   "publisher": "Cointelegraph",
   "date": "2026-01-21"
  }
 ],
 "indicators": {
  "domains": [
   "storewise[.]tech",
   "vagueentertainment[.]com"
  ],
  "addresses": []
 },
 "brief": "## Am I affected?\nYou may be affected if you use Linux and installed or updated an Exodus, Ledger Live or Trust Wallet app from the Snap Store, and it asked for your recovery phrase.\n\n## What to do now\nIf you entered a recovery phrase, make a new wallet on a clean device and move all funds now. Remove the snap and install the wallet from the vendor's official site instead.\n\n## How to avoid this\nGet wallet software only from the wallet maker's website. Check that the store publisher is the real vendor (verified badge). Treat any desktop app that asks for your recovery phrase as a scam.",
 "notes": null,
 "agentBrief": "# Hijacked Snap Store publisher accounts push fake Exodus, Ledger Live and Trust Wallet apps\n\n- Severity: High · Status: Still active (past)\n- Chains: Bitcoin, Multiple EVM chains · Method: Fake wallet and trading apps\n- Started: Jan 21, 2026 · Last update: Jan 21, 2026\n- Who/what: Linux users installing wallet apps from the Snap Store\n\nSlowMist reported that attackers re-registered expired domains belonging to established Linux Snap Store publishers, reset the publisher accounts, and pushed updates that turned trusted apps into fake Exodus, Ledger Live and Trust Wallet clients. The fake apps ask for the wallet recovery phrase and send it to the attackers. Linux users who installed wallet apps from the Snap Store should check the publisher and never type a recovery phrase into a desktop app. No loss total was published.\n\n## Am I affected?\nYou may be affected if you use Linux and installed or updated an Exodus, Ledger Live or Trust Wallet app from the Snap Store, and it asked for your recovery phrase.\n\n## What to do now\nIf you entered a recovery phrase, make a new wallet on a clean device and move all funds now. Remove the snap and install the wallet from the vendor's official site instead.\n\n## How to avoid this\nGet wallet software only from the wallet maker's website. Check that the store publisher is the real vendor (verified badge). Treat any desktop app that asks for your recovery phrase as a scam.\n\n## Indicators (block these, never visit them)\n- Domain: storewise[.]tech\n- Domain: vagueentertainment[.]com\n\n## Sources\n- SlowMist flags Linux Snap Store attack targeting crypto seed phrases (Cointelegraph, 2026-01-21): https://cointelegraph.com/news/slowmist-linux-snap-store-crypto-seed-attack\n\nFull record: https://drains.watch/i/snap-store-fake-wallet-updates-expired-domains-jan-2026 · JSON: https://drains.watch/i/snap-store-fake-wallet-updates-expired-domains-jan-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}