Bitcoin Forum

I'm not sure if y'all aware of it but if not: https://decrypt.co/63508/fake-trezor-iphone-app-scams-user-out-of-600000-in-bitcoin

Apple is known for it's rigorous process before allowing apps to it's app store, hence people tend to get bit loose with what they are downloading.

Fake trezor app passed through apple tests, multiple people fell for it, one with 17 BTC.

Don't depend on third party for your security.

So what OS must we use ?

(To be honnest I'm looking for to change my PC and I'm currently looking for more safety)

However, I think common sense is the best way to not get hack.

Used the app store to search for apps instead of going straight to the developer's site and verifying the download.
Downloaded a fake app even though Trezor doesn't even have an iOS app.
Didn't read all the reviews calling it a scam.
Blindly entered his seed phrase in to the fake app.
And now, according to the article, he blames Apple for "betraying his trust" and says they shouldn't be allowed to "get away with this". ::)

It always amazes me how someone can hold hundreds of thousands of dollars worth of bitcoin and yet still be so monumentally uninformed. He had to do literally everything wrong to fall for this scam. The slightest bit of knowledge or due diligence regarding any one of these steps and he wouldn't have fallen for this. But no, it's Apple's fault. ::)

A reputable Linux distro such as Ubuntu.

But more importantly than what OS you use is to not just download random pieces of software you stumble across like this user did. If you want to download a crypto wallet or app, then make sure it is open source, visit the developer's site or GitHub directly, and verify your download's PGP signature.

You may have heard already that there are less viruses made for desktop Linux (server Linux is a different story) than Windows, so Ubuntu LTS isn't a bad place to start. Vendors are starting to make versions of their programs specifically for it.

Alternatively, Linux Mint is based on Ubuntu and has mostly the same UI as Windows.


Yeah. If you see App A that has 500K downloads and an app B that pretends to look like App A but only has 5K downloads, then you have a pretty good feeling that App A is the real app and App B is a "fake" copy.

It's harder for fake apps to get hundreds of thousands of downloads, because the services they pay for to inflate downloads only have so many accounts and devices.

It's still much better than in case of Android. Also, a little bit of common sense would have saved his money.
As per my knowledge, there is no Trezor App for iOS.

People do stupid mistakes and blame it on an operating system.
"someone did a ransomware attack on my system, let's blame Windows despite me knowing I am visiting/downloading bad stuff".

I recently reported such a scam regarding Exodus that was on the Google store, but what I came across when looking into it is that people assume that if the Google store is so unregulated, then the Apple store must be a complete opposite, so they throw caution out of the window. The same skepticism should be involved in both cases because nothing is 100% safe.

A lot of people trust an app because it is in the store, we can't blame Apple for that because their store contains a lot of apps, but we can blame them if they don't remove the content early or after several notifications.
Before downloading any program, make sure to download the official version by verifying the signature and avoiding downloading many applications, even if they are reliable.

17 Bitcoin is not a small amount, you cannot be indifferent to your finances.

I dont believe that users got scammed due to downloading fake app directly from App Store. All apps passes tons of moderation before getting into App Store. Despite Google Play Store, which is full of fake and scam apps. It is mentioned that he had downloaded an app from App Store. That is a lie, there is no such app there and never was. Just another case of a user that does not care much about his security, as he "downloaded an app to check his balance". This is the same as checking cards balance on http://ismycreditcardstolen.com/ (warning! do not post your private data there)

According to the referenced article, the app was initially placed under the cryptography category, being allegedly intended for encrypting files and keeping passwords, but was later changed into the fake Trezor app. I presume the "change" was not a simple category movement of the app, but rather they swapped the code, changed the name and so forth. I figure that there are plenty of controls in the publishing process, but these are rather more laxed with updates.

There is such an app for everything type culture, that people presume that the app is going to exist on a/the store, without checking its legitimacy on the original site as a prior exercise. One would say that 17 BTCs and purchasing a Trezor would vouch for a sharp sense of awareness, but as exemplified here, its not always true.

The weakest link in the software is the user.
There are thousands of windows users who haven't got "hacked" and tricked into downloading malware and there are also thousands of user who have downloaded crap even on iOS on on other Linux systems, people should understand that Linux is not some kind of bulletproof solution to everything and once you got that on your computer you're completely safe.

The exact thing happened to the victim he believed nothing could go wrong and he went whistling through all the steps o_e_l_e_o mentioned and probably a lot more users did the same but they've kept quiet about their loss.



So you claim that all those people lie and you know better?

AFAIK, it is not possible to install any apps on IOS without jailbreaking it so user itself is making their device vulnerable while doing such activities. we also cannot trust the apps available on their app store but we can spend few minutes to read the reviews of it to find whether it is actually a legit or launched recently. I am actually a hater of IOS because of their unfriendly user interface so I am using Android and Windows but I know what I am doing that is why I didn't lose any money to those fake apps.

This is the moment people should realize how bad their knowledge about security is and how bad their habits are.
The vast majority of users are blindly downloading all sorts of apps, blindly trusting anyone around as a sacrifice for their own convenience. It's their own fault and not Apple's, the same way someone cutting their finger with a knife is their own fault for having bad cutting habits.

As time goes on and Bitcoin becomes more expensive, what happens is these guys only get better and better strategies going on to steal your coins. And since almost nobody cares how safe their devices truly are, the number of potential victims is huge. Just think about the insane number of people storing their personal information/files on cloud storages without pre-encryption. This alone shows so much about how careful humans really are..

If there are fewer people getting hack on linux isn't because people on linux are more aware and more educate about informatic ?

Fake application is really common in apple and even with the android, mostly most of the beginners think that when they have downloaded an application from a google play store then it is already safe but that is not true, there are still a lot of scammers who created an application and I don't know how it enters the google play store, The google play store should be aware for this and take some action to remove all those stuff.

I did not know that fake apps manages to sneak through App Store moderation. Probably the amount of scam/fake in App Store is so little, so people does not talk about that much. Thanks for info. Now I will not feel as much secured as previously and install apps from App Store in a rush.

Debating on whether it's possible or not to pose a fake app on the Apple Store, it shouldn't be the focus here. I think informing users that these types of schemes are possible to be scammed should be reported. Sharing information on potential scams is a help. It was indeed better to share how to avoid it in the first place. Most people just blindly trust something that they saw and believe it right away without doing possible research.

Be vigilant with what you download.

I do not use mobile cryptocurrency applications. It is very dangerous. Now every application can spy on and transfer data about other applications that you have installed on your phone.
It has already been said that if you are a bad Linux user, then use Windows and hardware wallets.
And it is very reckless to store large amounts of money on mobile wallets.

People are so used to mindlessly installing apps, that they do it even if they are going to entrust this app with hundreds of thousands of dollars. They probably don't visit Bitcoin forums and never seen a topic about fake wallet resulting in massive theft, otherwise they'd take at least take some steps to verify the software that they want to use.

It's also so stupid to hodl all your coins in one wallet, if that person had multiple wallets, they'd only lose a portion of their coins.

Looks like he actually did download from the official App Store. And as someone else said above the scammers initially launched a legit app under another name and then later they morphed it into totally another app of another category under new name. Why would they allow this?

The guy looks like seeing a doctor now and taking medicines. Idk what condition would I be if I lost 600k like this and shortly after it is more than $1M lol.

This is the same with those Google Play Store fake apps that they've allowed to be published. Apple should also pay attention to this detail to avoid further displaying and publishing of potential fake apps in the feature in their platform. Google isn't paying attention on this and only relies to the reports of good people onto their platform but with Apple, they're stricter and after this incident, I think that they're going to pay attention on it. As users, we should be careful with everything we download, whether we use Apple's OS or Android or Windows or with any other OS's.

Probably it is because some fake applications are allowed in the Store as well as the case in the Google store but when you compared the two there are many more fake applications in the Google play store.

Third-part applications have a lot more restrictions when using something like an Apple product, it might not be allowed when you download an application online and not from the store.

But we know it can be bypass at some point, but you could say that it is safer than windows or android software, but it is still not perfect so we still need to be careful.

This is not about what you and I believe concerning the situation happening in the Apple and Google play store but it something that has been proving by a lot of people. However, it will be a wrong decision to put your security in the lite/no genuine moderation done by the Appstore and Google play store because hackers and online theft are coming up with new scams ideas.

It understandable that nothing is 100% safe but when it comes to an app store like Apple and Google they shouldn't be this easy to be fool by scammer which means they are absolutely not doing their job very well in terms of moderating the app they have on their platform.

This is the main role of the security, we will not safe if we are not controlling our online activity. some people got trapped by clicking not important ads, visiting fake sites and more reason that very clear if he not aware with his security. we we more careful, find information before download, so we can prevent at least 80% from attack

It's true that Apple pays way more attention to security than Google, but you are very wrong if you think that their screening system is infallible.It happened to them before in the past (albeit they pay more attention now) and will occasionally keep happening. Sooner or later fake app will pass all the controls and end up on App Store as scammers tend to be very creative and imaginative. It is always a game of cat and a mouse.


Exactly this. Over the years people got used to download apps directly from App Store/Google Play so when they decide to get their first crypto wallet, in 99.99% cases they will do exactly the same thing as many times before. I mean, from their point of view why wouldn't they, in all those years everything worked fine.

You are kidding yourself if you think Apple or Google care about you, at all. They care about making money, and if scammers are willing to pay them, then Apple and Google will happily take their money. From fake apps on their respective app stores, to fake and scam extension on their browsers, to scam results being pushed to the top of Google results, to running ads from known scammers, to mining your data and selling it to third parties, the list goes on. You cannot rely on these companies to protect you in any way. They will happily sell out you, you security, and your data, if scammers are willing to pay them for the opportunity.

We've seen all kinds of apps lead to the theft of bitcoin, everything from fake wallets like in this case, to something as simple as a new theme which had a keylogger built in and stole seed phrases as they were being entered in to legitimate wallet apps. If you use your phone for bitcoin, then you should download the bare minimum number of apps on it, and only open source reputable apps from sources your trust, ideally verified prior to installing. The same holds true for your computer or any other electronic devices. Each additional piece of software, app, browser extension, etc., you download is an added risk.

All those who lost BTC to this are to be blame for their misfortune, there is no trezor app on IOS and again it would have safe them alot if they do research first than trusting a third-party, when it comes to money or assets storing apps do not use any online stores, go straight to the app official website and download from there

We ain't safe any longer with what download anymore. This is the worst experience ever to lose all your savings in a twinkle of an eye.
This is the main reason why I go through all the recommendations rating of an app before I choose to download it.
The world will leave in is full of scams. The third parties shouldn't be trusted either when transacting information with them

Couldn't believe it myself that Apple as stated by the OP who is known for their rigorous and strict requirements for apps to be published in their Appstore, I hope that Apple has taken an action towards this malware app that passed through their requirements
 Nowhere online is safe anymore for this normal people who are naive when it comes to their online security, this event also serves as a PSA to every newbies and long time users in the forum to be careful on what you are clicking/download online because sometimes our arrogance that we might not be the victim of this kind of schemes will be our eventual downfall.

Reviews should be read, but that on its own is no certain safeguard. This particular app has 155 reviews, mostly in the 5 star range. Not a massive amount, but enough for somebody that relies on this criteria alone to install the app, to his later to be met dismay.

This is very similar to those fake sites that follow the same procedure, and demand your 24 word mnemonic. Perhaps Trezor (not only them) should make it very clear in their material that they won’t ever ask for this information themselves, neither on any site nor app. The enclosed card warns about not revealing this info to others, but should probably emphasize that sites/apps with their brand (Trezor) as a claim are no exception to this.

I only thought that android was the worst operating system for cryptocurrency but it seems none of these big companies are able to stop scammers from doing cryptocurrency scams by using their platform. I assume  the biggest falt lies with the user who does not ever verify what he or she is downloading from these store. It is beeter to directly visit the service provider website in order to download any cryptocurrency app on your device.

It having most 5 star reviews is red flag in itself.

The scammer was a genius, able to trick the user who had lost his btc...
what you say is right, why does he not directly download the official application from trezor because usually, the official site includes a link to their original application on the app store. *big unexpected loss

Apple store is for IPhone what Playstore is for Android. When Apple store is compared to Playstore, its relatively very safe than the playstore. Apps on Playstore barely go through any severe scrutiny, mostbof the apps available on playstore are mainly apps that have been able to satisfy minimal conditions of which the most of it ends in a fee, who wouldn't afford that especially when what they stand to gain through there phishig or scam platform. Mean while, apple does a lot of scrutiny and verification on the apps in there apple store. Compared to android regular playstore, apple store is safe but, its best you always verify an app form its official site before downloading.

That's the human fault if they fell to the traps of a scammer because no matter what security you put on something for its safety there's nothing you could do if you fall for the traps of a scammer. The only way to avoid this from happening in the future is to be very cautious to everything you take from the internet because scammers are always planning way ahead of you. So check every reviews you see on the product or apps that you like to download but be wary because not all reviews are legit because you can easily identify a type of review that is written exaggeratedly to promote such apps/projects.

I think there is no such thing as safe, from any kind of operating system or applications, if you just allow applications in your mobile, computer, or laptop, that will be the end of it, if you never care to read or research what is going to be installed, at the same time make sure the source is safe, and take time to review comments from any applications, you are going to put in your devices.

Our safety lies in our hands. If we're vigilant and aware of what we're downloading, we're safe if we're downloading the official app of any product. Before downloading, we're too resourceful to know who are the sources and if they're trustworthy and reputable, in that initiative, you'll know the fake apps and the official ones.

Be careful too with the reviews below, I've seen apps that has thousands of downloads made by the culprit and probably paid people just to increase the number of downloads and to do fake reviews.

It's always a common norm for many people to not read reviews in Apple store when compares to Google playstore because the trust Apple too much.

Somehow, I feel Apple is to be blamed for this sort of issues. They do claim that https://www.apple.com/app-store/

I wonder how they miss this sort of activity if truly their moderators are working every day.

Apple's fault was to not discover and remove the fake application. It's not Apple's fault that users didn't check what they were downloading and trusted that others (Apple staff) did their job for them. If the user was that reckless with his coins, it was just a matter of time when something bad would happen. He might have been lucky in the past, but this time it unfortunately caught up on him.

I work every day and I make mistakes because I am human, don't you? Those tasked to supervise me, recognize those mistakes and correct them. It's a team effort and there is always someone who is not at his best. I have corrected my direct supervisors several times. Keep your eyes open at all times, especially when you dealing with money. 

I disagree. Apple boasts that all apps are safe. That is, some responsible people must check the application several times before allowing this application for general use. I do not see any human factor here but only see human carelessness.
The scammers substituted and provided a safe version of the utility, which in no way justifies the App Store itself.
We know today that an audit was conducted following this event and several more apps were removed from the App Store. This suggests that nothing is perfect. All talk about reliability and safety, this is just an advertisement for your brand. Therefore, of course, you must always rely on your knowledge and a cool head.

@lovesmayfamilis
Although you said you disagree with me, you agreed with me on some points. :)

Exactly. Don't rely on others and check everything yourself. If I recommended a great app to you and said there is no need to check it, I already did and it's safe, would you just trust me or carry out your own inspection? Maybe I am the best in the business, but I could still have overlooked something, made a mistake, or I am just having a bad day.

Of course. All ads lie. They are always going to say we are the best, fastest, cheapest, most renowned. No one is going to advertise their brand as kind of ok, relatively expensive, and mediocre.   

This reminds me of Indian detergent ad where they spill out coffee, tea and some other stain causing things, use their 'magic' detergent powder and voilà the shirt is crystal clean. Meanwhile, me trying to remove couple stains of tea with same detergent, it didn't do shit.

Okay so the original creator of the app posted a legit app.  What was name of app?  Then they change the app to the fake trezor app?  I am getting confused on this part.


So when the guy downloaded trezor app from the app store... it then ask for his seed and he then manually typed it in right?  Then moment he did that, the coins were immediately lost?


How does one protect oneself then when downloading any apps from the apple app store then?  Im sure tons of you download like some video games there to play right?  But as long as you make sure it has thousands of reviews... then its safe?  I always check the reviews and see how many reviews an app has before i download it on my iphone.  But could any apps you download have keylogger?  I know there is keepass on apple store so wouldn't that mean if you download and store all your passwords in it... the legit keepass for example... well any app you download could be malicious and it could read all of your passwords on your keepass if it has keylogger?

That is what the available information suggests, being the prior app in the line of one to encypt files and store passwords. I haven’t manages to find the original name of the app though.

Not exactly immediately (I doubt they have this past of the process fully automated), but very rapidly for sure. As soon as the people behind the fake app receive someone’s entered 24 word mnemonic, they’ll simply create a wallet using it, having thus access to the stored crypto, and being able to see and manage/move it at their will.

Apple is way safer than Android, but as this case exemplifies, there is no completely certainty that an app may include some sort of malware or be a hoax, and one should try to minimize what is being installed on sensitive devices, besides making sure it's legit. In this particular case though, knowing what is feasible and what is not (Trezor asking for the mnemonic) is paramount.

I often wonder if the native operating system resources have/may, at some point, log and forward some of the data one types …

I doubt they is any safe security anymore apple , Android etc.i just advice before you  listen before you pick a wallet to safe your money that what I prescribe because everything now is written scam .