Trezor Fake Iphone App Phillipe Christodoulou

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' and 'General Prevention' sections to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Trezor

Trezor did now have any IPhone version of their application. A scammer created a fake IPhone Trezor application. This was downloaded and requested the sensistive information, presumably the seed phrase. Once provided, all balances on the wallet were stolen. The app has since been removed. It is unclear if any funds were recovered.

About Trezor

"The safe place for your coins." "Store your coins with Trezor." "Hardware wallet is the safest way to manage & trade your cryptocurrencies."

"Apple touts its store as “the world’s most trusted marketplace for apps.” Speaking to the Washington Post, a spokesperson for Apple explained that all apps undergo a rigorous review process—but acknowledged that there have been other cryptocurrency scams on the App Store." "Apple bills its App Store as “the world’s most trusted marketplace for apps,” where every submission is scanned and reviewed, ensuring they are safe, secure, useful and unique."

“User trust is at the foundation of why we created the App Store, and we have only deepened that commitment in the years since,” said Apple spokesperson Fred Sainz. “Study after study has shown that the App Store is the most secure app marketplace in the world, and we are constantly at work to maintain that standard and to further strengthen the App Store’s protections. In the limited instances when criminals defraud our users, we take swift action against these actors as well as to prevent similar violations in the future.”

"Per a report in The Washington Post, Trezor user Phillipe Christodoulou had stored his Bitcoin on a Trezor hardware wallet, and—wanting to check his balance—downloaded an app purporting to be from Trezor on the iOS App Store." "Phillipe Christodoulou wanted to check his bitcoin balance last month, so he searched the App Store on his iPhone for “Trezor,” the maker of a small hardware device he uses to store his cryptocurrency. Up popped the company’s padlock logo set against a bright green background. The app was rated close to five stars. He downloaded it and typed in his credentials."

"Although Trezor does not currently support Apple's iOS mobile operating system and does not have a mobile app, [an] app used the company's name and branding, and had a user rating of nearly five stars—making it appear trustworthy." "Up popped the company’s padlock logo set against a bright green background. The app was rated close to five stars." "[T]he Trezor app had 155 reviews on the App Store for a rating of close to five stars, according to App Figures, the analytics firm."

"In this specific instance, the fake Trezor app was initially presented in the “cryptography” category—as a solution for encrypting iPhone files and storing passwords—before it was changed by the developers into a crypto wallet app." "The thing is, Trezor — which manufactures very-secure hardware wallets — doesn’t actually have an app, so when the holder entered the seed recovery phrase for his wallet, he was unwittingly handing the keys to his bitcoin over to the peddlers of a fake application."

"After Christodoulou downloaded the app and entered his credentials, all of his crypto immediately disappeared." "In less than a second, nearly all of his life savings — 17.1 bitcoin worth $600,000 at the time — was gone. The app was a fake, designed to trick people into thinking it was a legitimate app." "A malicious smartphone app on Apple’s App Store, mimicking the name and visual style of Trezor hardware wallets, was used to steal 17.1 Bitcoin (BTC) from an unsuspecting user—worth $600,000 at the time."

"Only one of Christodoulou’s 18.1 bitcoin was spared because he transferred it to a bitcoin savings service called BlockFi. At the time of the theft, his 17.1 stolen bitcoin were worth $600,000, but they soon went up in value to $1 million."

"Christodoulou is angrier at Apple than at the thieves themselves: He says Apple marketed the App Store as a safe and trusted place, where each app is reviewed before it is allowed in the store."

"Christodoulou, once a loyal Apple customer, said he no longer admires the company." “They betrayed the trust that I had in them. Apple doesn’t deserve to get away with this,” Christodoulou said.

"[I]n fact, it’s easy for scammers to circumvent Apple’s rules, according to experts. Criminal app developers can break Apple’s rules by submitting seemingly innocuous apps for approval and then transforming them into phishing apps that trick people into giving up their information, according to Apple. When Apple finds out, it removes the apps and bans the developers, the company says. But it’s too late for the people who fell for the scam."

"That evening, Christodoulou went into the App Store again to look more closely at the reviews." "When Christodoulou opened up the written reviews, he read complaints from other people who had been scammed in the same way. The five-star ratings that helped make the app seem legitimate must have been fake, he concluded."

"The app that was used to scam Christodoulou was available on the App Store from at least January 22 to February 3 and was downloaded around 1,000 times."

"Christodoulou says he’s taking medication and seeing a psychiatrist." “It broke me. I’m still not recovered from it,” he said.

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - Trezor Fake Iphone App Phillipe Christodoulou

Date	Event	Description
January 22nd, 2021	Application Reportedly Appeared	According to The Washington Post, and third party Sensor Tower, the Trezor application was able to get through Apple's application screening process. Even though it had the name "Trezor" and the Trezor logo, the developers claimed to be providing an application which would encrypt iPhone files and store passwords. It would appear that this description by the developers was enough to fool the Apple team into approving the application.
February 1st, 2021	Philip Christodoulou "Checks His Balance"	Philip Christodoulou downloaded and set up the application so he could check his bitcoin balance on his phone instead of his computer. "[T]he Trezor app had 155 reviews on the App Store for a rating of close to five stars, according to App Figures, the analytics firm." As part of the setup process, he entered his seed phrase. Immediately afterward, he plugged his Trezor hardware wallet into his computer and found that his balance was gone.
February 3rd, 2021	Application Reportedly Removed	According to The Washington Post, and third party Sensor Tower, the application was removed from the app store at some point on February 3rd.
March 30th, 2021 5:00:00 AM MDT	Washington Post Article	The Washington Post publishes an article on the situation. They state that a new report has found that Apple’s review process for apps in its App Store can be easily circumvented by scammers, despite the company billing its store as “the world’s most trusted marketplace for apps”. Criminal developers can break Apple’s rules by submitting innocuous apps for approval and then transforming them into phishing apps that trick people into giving up their information, the report found. The report follows news of a fake Trezor app, which purported to be the bitcoin wallet provider but was actually a scam designed to trick users into losing their investments. The scam was successful, with at least five people reporting losses of $1.6m. Apple’s review process has been put in the spotlight by the Epic Games lawsuit, with the gaming company accusing Apple of operating a monopoly over its App Store. TBD there are revisions/edits on this article that may be noteworthy.
March 30th, 2021 10:19:00 AM MDT	Jameson Lopp Twitter Post	Jameson Lopp posts on Twitter in response to the news to remind users that they should only ever enter seed phrases in their hardware wallet hardware itself, and never in an application.
March 31st, 2021 11:09:48 AM MDT	Decrypt Article	Decrypt publishes an article on the situation. A fake smartphone app purporting to be from cryptocurrency hardware wallet manufacturer Trezor has been used to scam users out of their Bitcoin. The app, which used Trezor’s branding and had a user rating of almost five stars, stole 17.1 Bitcoin, worth $600,000 at the time, from one user alone. Although Apple claimed all apps undergo a rigorous review process, the fake app was available on the iOS App Store from 22 January to 3 February and was downloaded around 1,000 times. Trezor also warned users of a malicious Android app on the Google Play Store in January this year.
April 5th, 2021 2:54:04 AM MDT	TecTalk Article Published	The situation is reported on TecTalk. They report that a fraudulent app called Trezor for trading cryptocurrency has stolen $1.6m in bitcoins from at least five people on Apple's App Store. The app went through Apple's verification process before being made available for download. One user, Phillipe Christodoulou, lost 17.1 bitcoins, worth about $600,000. Apple claims the app's developers used a bait-and-switch technique, providing a safe version of the app for verification before changing it to a cryptocurrency wallet. In response to the incident, Apple conducted an audit and removed several apps from the store, but did not provide details of which apps or how many.

Technical Details

This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

The process of getting by Apple's process was described in The Washington Post article.

The fake Trezor app got through the app store through a bait-and-switch, according to Apple. Though it was called Trezor and used the Trezor logo and colors, it represented itself as a “cryptography” app that would encrypt iPhone files and store passwords, according to Apple. The developer of the fake Trezor app told Apple’s review team it “is not involved in any cryptocurrency.” Apple approved the app and it appeared in the App Store on Jan. 22, according to mobile analytics firm Sensor Tower.

Total Amount Lost

The total amount lost has been estimated at $600,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

General Prevention Policies

There is no reason to ever enter a seed phrase into an application. All hardware wallets on the market establish that any phrase should be entered into the hardware wallet hardware itself.

Always check and visit the official website of a service. The majority of funds should be stored offline and not on a live wallet application. When setting up a new wallet or upgrading wallet software, never enter your pass phrase or send any funds without first transferring a smaller amount.

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.