# Hijacked Snap Store publisher accounts push fake Exodus, Ledger Live and Trust Wallet apps

- Severity: High · Status: Still active (past)
- Chains: Bitcoin, Multiple EVM chains · Method: Fake wallet and trading apps
- Started: Jan 21, 2026 · Last update: Jan 21, 2026
- Who/what: Linux users installing wallet apps from the Snap Store

SlowMist reported that attackers re-registered expired domains belonging to established Linux Snap Store publishers, reset the publisher accounts, and pushed updates that turned trusted apps into fake Exodus, Ledger Live and Trust Wallet clients. The fake apps ask for the wallet recovery phrase and send it to the attackers. Linux users who installed wallet apps from the Snap Store should check the publisher and never type a recovery phrase into a desktop app. No loss total was published.

## Am I affected?
You may be affected if you use Linux and installed or updated an Exodus, Ledger Live or Trust Wallet app from the Snap Store, and it asked for your recovery phrase.

## What to do now
If you entered a recovery phrase, make a new wallet on a clean device and move all funds now. Remove the snap and install the wallet from the vendor's official site instead.

## How to avoid this
Get wallet software only from the wallet maker's website. Check that the store publisher is the real vendor (verified badge). Treat any desktop app that asks for your recovery phrase as a scam.

## Indicators (block these, never visit them)
- Domain: storewise[.]tech
- Domain: vagueentertainment[.]com

## Sources
- SlowMist flags Linux Snap Store attack targeting crypto seed phrases (Cointelegraph, 2026-01-21): https://cointelegraph.com/news/slowmist-linux-snap-store-crypto-seed-attack

Full record: https://drains.watch/i/snap-store-fake-wallet-updates-expired-domains-jan-2026 · JSON: https://drains.watch/i/snap-store-fake-wallet-updates-expired-domains-jan-2026.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.