MYETHERWALLET

DESCRIPTION OF EVENTS

"MEW (MyEtherWallet) is a free, client-side interface helping you interact with the Ethereum blockchain. Our easy-to-use, open-source platform allows you to generate wallets, interact with smart contracts, and so much more."

"Taylor Manahan and Kosala Hemachandra founded MEW (MyEtherWallet) back in 2015, not long after Ethereum was created."

"One consequence of the recent cryptocurrency craze is that people are increasingly more interested in downloading a wallet on their phones. But it seems scammers have found an opportunity to exploit this trend – and are now actively seeking to dupe gullible Ethereum holders with malicious MyEtherWallet copycats on Google Play."

"There is fake @myetherwallet on Google Play that requires user's private key or mnemonic phrase to log in." At the time there wasn't "any official MyEtherWallet, yet."

"Of course, there's the typical fake comments. Grabbed myself a copy of the APK to check out later on."

"Malware researcher Lukas Stefanko has taken to Twitter to warn users away from a malicious instance of the popular Ethereum wallet that is currently being distributed on Google’s official mobile software platform."

"[T]here is a FAKE MyEtherWallet app on Google Play that has yet to be removed. Please help us light a fire under @GooglePlay’s butts and get it taken down!"

"Phony MyEtherWallet apps pose a serious threat to gullible users who may not be able to tell a legitimate app apart from the fakes, and a significant amount of money could be stolen by enterprising hackers with some basic development skills who are releasing these MyEtherWallet apps that masquerade as an official representation of the website."

"And as an FYI, there are currently no official MyEtherWallet apps available. Always verify for truth before downloading an app, visiting a site, or inserting any information anywhere."

MyEtherWallet is a widely used and popular wallet which was not available on the Google Play store in January 2018. A malicious version of the application was created on Google Play, and users were tricked into installing it.

The malicious application would prompt users to enter their private keys or set up compromised wallets. It's not clear if any funds were stolen or how much in this case.

HOW COULD THIS HAVE BEEN PREVENTED?

Cryptocurrency users need to always make sure that they are accessing any downloads directly on the official website. Unless infeasible, it's safer to transfer only a small wallet to any newly downloaded software, and wait prior to moving any significant sums over. (Malicious wallet developers typically sweep funds soon after any deposit is made.) Most blockchain updates are backwards compatible. It's a good idea to always ask trusted friends if you receive news of an update. Never make a rushed decision to download any new wallet software. Store most of your funds offline on a hardware wallet or paper copy, with a backup seed phrase, and set up a multi-sig if you have the technical knowledge to do so properly.

Check Our Framework For Safe Secure Exchange Platforms

Ethereum thieves targeting Android users with fake MyEtherWallet apps (Jan 18)
@LukasStefanko Twitter (Jan 21)
@myetherwallet Twitter (Jan 21)
Hackers Stealing Ethereum With Fake MyEtherWallet Apps (Jan 21)
The Ethereum Scam Database helps you avoid cryptocurrency scammers (Jan 18)

More case studies

Benebit
Exit Scam

Experty ICO Leak
and Phishing Attack