Crypto App Scam Drains $70,000 Using Advanced Evasion Tactics on Google Play
Researchers from Check Point Research recently uncovered a crypto scam app on the Google Play Store, responsible for stealing over $70,000 in digital assets over five months. The app, posing as the legitimate WalletConnect protocol, managed to evade detection by using advanced tactics, allowing it to stay active and harm unsuspecting users.
The app’s primary aim was to gain access to users’ crypto wallets, a crucial tool used to connect wallets with decentralized finance (DeFi) platforms. According to Check Point Research’s Sept. 26 report, this incident is particularly concerning as it marks the first time mobile users were specifically targeted by such a sophisticated wallet-draining scheme.
Fake App Achieves Over 10,000 Downloads
The fraudulent app, cleverly disguised and aided by fake reviews, achieved over 10,000 downloads by ranking high in Google Play search results. Its convincing appearance allowed it to deceive a significant number of users.
However, not all users who downloaded the app fell prey to the scam Some users did not link their wallets or realized something was wrong early on, while others might not have met the specific criteria required by the malware to steal their assets.
How the Scam Worked
Initially published on March 21 under the name “Mestox Calculator,” the malicious app used advanced evasion techniques to bypass Google Play’s security checks. Although the app’s description and name changed over time, it consistently pointed to an innocent-looking website offering a calculator tool.
The attackers used this deception to pass Google Play’s review process, which relies on automated checks to verify the app’s legitimacy. Once the app was downloaded by users meeting specific criteria (such as IP address location and device type), they were redirected to a malicious backend hosting wallet-draining malware called MS Drainer.
By requesting permissions to “verify users” wallets, the app gained the ability to authorize transfers of the maximum possible amount from the victim’s wallet. The malware was designed to target the highest-value tokens first, gradually draining the assets.
Increasing Sophistication of Web3 Scams
This incident serves as a clear reminder of the increasing sophistication of scams aimed at the Web3 space. Check Point Research emphasized that the app did not rely on traditional methods like keylogging or over-permission access. Instead, it leveraged smart contracts and deep links to carry out its asset-draining activities without arousing suspicion.
The incident underscores the need for app store platforms like Google Play to enhance their security verification processes to prevent similar scams from slipping through.
Caution and Education Key to Preventing Losses
While the app has been removed, Check Point Research advises users to be extremely cautious when downloading apps related to crypto wallets and DeFi services, even from seemingly secure platforms. They also stress the need for continued education within the crypto community to raise awareness of the risks associated with Web3 technologies.
I am Toby Rothschild, Co-Founder of Spearmint and author at Coinography, and a strategist focused on advancing Web3 innovation, digital ecosystems, and the future of decentralized technology. I combine product thinking, creative leadership, and deep interest in emerging trends to help shape how individuals and organizations interact with the next generation of digital systems.
My work centers on understanding how blockchain, AI, and digital identity are reshaping global industries. At Spearmint, I help lead the direction of initiatives that bring clarity, structure, and meaningful user experiences to complex technological environments. I focus on bridging vision with execution, ensuring that innovation remains practical, scalable, and aligned with long-term growth.
As an author at Coinography, I create insights that translate fast-moving Web3 developments into clear, useful narratives. I explore topics such as decentralized governance, digital identity, creator economies, token models, protocol design, and the shifting cultural patterns around emerging technology. My aim is to make digital transformation more understandable and approachable for a wider audience.
I believe that Web3 is not only a technological shift but a cultural and creative one. Strong ideas, thoughtful communication, and human-centered design will shape which technologies thrive and how communities evolve around them. My writing and research reflect this belief, focusing on clarity, relevance, and long-term perspective.
Professional Links Website: https://coinography.com LinkedIn: https://www.linkedin.com/in/tobyrothschild/
