[WARNING]FAKE ELECTRUM WALLET

[Peanutswar]

When searching for an electrum wallet to google play I found this fake electrum. All images are the same as the electrum app and also the description, they just change the email, website, and the github.

Google play link

Code:

https://play.google.com/store/apps/details?id=com.globalboost.apps.electrum

Code:

Registrant Contact Information:
Name: REDACTED FOR PRIVACY
Organization: GlobalBoost
Address: REDACTED FOR PRIVACY
City: REDACTED FOR PRIVACY
State / Province : DC
Postal Code: REDACTED FOR PRIVACY
Country: US
Phone: REDACTED FOR PRIVACY
Fax: REDACTED FOR PRIVACY
Email

Expires On2021-09-24
Registered On2014-09-24
Updated On2020-09-26

Information Updated: 2020-11-21 03:56:43

EDIT :

Code:

The real Electrum.

[1715232242]

1715232242

[1715232242]

1715232242

[Maus0728]

Even though that this Phishing attack is expected among bitcoin wallet. There is also another electrum wallet with the same name and also offers a good UI compare to the original but you can clearly see that this is an attempt of fraud and could cause some confusion for bitcoin newbs  .

Surprisingly, the application has a lot of good reviews which can cause people to be enticed with this wallet LOL.

[Chikito]

He copycats from electrum wallet 4.0 version https://github.com/GlobalBoost/electrum I won't surprise even electrum wallet had 2,7K forked already. but the problem is he didn't admit permission to copied Electrum code, I don't see his name on the forked member. you must report it to google as abuse of copyright.

[Charles-Tim]

Too many different versions of electrum wallet on google playstore, likely this could be one of the scam electrum wallets, that is why we need to make use of electrum official site, electrum.org, for electrum wallet download, and the signature can be verified. There have been many fake apps on google playstore before and there will be many more that will still appear, they have cost users millions of dollars lost, other examples of such fake wallets that have reportedly scammed users are fake trezor app, polonix and the recent uniswap app scam on play store that scammed user $20000 recently. We need not to make use of google for anything if we need privacy and security, making use of the app store could lead to scam. Recently, I was also reading about some other fake apps like Whatsapp and some other ones that have led to people being scammed through stealing of information and 2fa codes from the victims which can lead to bitcoin wallet being compromized. The best is to just access the official sites for any download we need and also making sure the official sites is the correct one and not fake one.

[clifjw]

I'm new to crypto and I made the mistake of installing from Google Play. The one I got was this...



Is that the right one? Or should I uninstall and install the version from Electrums website and restore with seed phrase?

[joniboini]

Is that the right one? Or should I uninstall and install the version from Electrums website and restore with seed phrase?

According to the Electrum website, the app is available to download from https://play.google.com/store/apps/details?id=org.electrum.electrum. So check that out.

A better way would be to download the apk from https://electrum.org/#download, verify the signature, and if everything checks out you can use it.

[Maus0728]

Is that the right one? Or should I uninstall and install the version from Electrums website and restore with seed phrase?

Yep, that is the original.

Why not try using Electrum in your desktop computer so that you can also practice verifying GPG signatures using Kleopatra?  Having the right knowledge of verifying GPG signature will allow you to not fall from fraudulent phishing application that swarms the internet, it'll also add additional skill whenever you need to encrypt or decrypt messages...

But anyways, just make sure that you will not download any application from random websites and back up your seed phrases safely away from other people's eyes.

[clifjw]

Yep, that is the original.
Why not try using Electrum in your desktop computer so that you can also practice verifying GPG signatures using Kleopatra?  Having the right knowledge of verifying GPG signature will allow you to not fall from fraudulent phishing application that swarms the internet, it'll also add additional skill whenever you need to encrypt or decrypt messages...
But anyways, just make sure that you will not download any application from random websites and back up your seed phrases safely away from other people's eyes.

Thanks Maus0728 appreciate the confirmation. You've put my mind at ease. I'm learning constantly though.
TBH I haven't much thought about running a desktop wallet mainly due to just getting started with crypto. A mobile wallet and a Ledger (which I'm going to get probably this week) for openers. I will advance with maybe a desktop version once I feel more comfortable with the basic stuff. Thanks for the suggestion though.

[ranochigo]

but the problem is he didn't admit permission to copied Electrum code, I don't see his name on the forked member. you must report it to google as abuse of copyright.

Does copyright laws apply in this case? Electrum is opensourced with the license allowing the use of the source code. I doubt it would actually be considered as a copyright infringement in this case.

Actually this presents a pretty big issue; users can't possibly verify the hashes of APK (Downloaded from GPlay) and it doesn't make sense for most to sideload Electrum either. Guess this is a pretty good point to dissuade people from using a mobile wallet as their primary wallet.

[o_e_l_e_o]

You've put my mind at ease.

So although the wallet you have downloaded is indeed the official one, and therefore you are almost certainly completely fine, there is still a potential attack vector. It is the same as when people recommend only downloading from https://electrum.org/#download. Although that is the official site, and they are correct you shouldn't download Electrum from anywhere else, simply using the official site to download from is not enough to guarantee your security. Sites can be compromised or hacked and have malicious pieces of software uploaded to them. That is why you must verify your Electrum download has been signed by ThomasV (the lead developer) by using the signature files provided at https://electrum.org/#download and his public key, which I have put at the bottom of this post (although you should also verify this key from other sources to ensure that I am not trying to trick you in to using a fake key).

There are good instructions on how to verify Electrum here: https://bitcoinelectrum.com/how-to-verify-your-electrum-download/
You can download the mobile app and its signature file to your desktop computer, verify it there, and then transfer it to your mobile device for installation (you'll need to allow installation of apps from unknown sources in your phone's security settings).

ThomasV's public key fingerprint:

Code:

6694 D8DE 7BE8 EE56 31BE D950 2BD5 824B 7F94 70E6

Same key available on OpenPGP Keyserver: http://keys.gnupg.net/pks/lookup?op=vindex&fingerprint=on&search=0x2BD5824B7F9470E6
Same key available on Electrum GitHub: https://github.com/spesmilo/electrum-docs/blob/master/gpg-check.rst
Same key available on Electrum Documentation: https://electrum.readthedocs.io/en/latest/gpg-check.html

[khaled0111]

@clifjw, you don't have to ask anyone to help you with this. Check the file's signature for yourself and this is what you have to do with every software or file you download from the net.
"Don't trust, verify!"
As you can see, even the wallet mentioned in op has many good reviews but they are all fake. (not saying that the one you downloaded is fake)

[Alucard1]

I a new user of electrum, thankfully I downloaded the legit one that is recommended by one of my friends, I don't think that I could determine that wallet as a scam if ever no ones recommend me the legit one because I don't have much knowledge about this kind of wallet before.

A lot of fake crypto wallets is existing in this virtual world and most of them can be downloaded in the google play store, so always be careful with that. It would be better if you ask for some help and advice from one of your tour friends that already have many experiences with cryptocurrency or better ask it to this forum.

[robelneo]

I a new user of electrum, thankfully I downloaded the legit one that is recommended by one of my friends, I don't think that I could determine that wallet as a scam if ever no ones recommend me the legit one because I don't have much knowledge about this kind of wallet before.

A lot of fake crypto wallets is existing in this virtual world and most of them can be downloaded in the google play store, so always be careful with that. It would be better if you ask for some help and advice from one of your tour friends that already have many experiences with cryptocurrency or better ask it to this forum.

As a full member you should know how to differentiate a fake one from a legit one, Electrum is not the one wallet you are going to use
You can check the public signature key like the one showing here on Electrum https://electrum.org/#download you can install the Alexa extension, a fake website will never show a good traffic ranking, and as addition, you can check the official announcement thread here.
Do not rely on the third-party recommendation it's risky.

[akirasendo17]

as bitcoin boom so is scams fake wallet, to steal money from us, we should be aware now as their lots of post, news how they get or steal money, even exchange gets hack, if you are aware of what is going on in the environment there is a low chance that we can be a victim, they will always be in front of us but if we check, verify everything before we click or download it we can ba save.

[hugeblack]

In the coming years, we will witness more of these wallets in more professional ways, since the code is open source and any programmer can modify it by changing the name of the wallet, and no one will be able to block the application.
I was hoping that electrum's wallet would seek to obtain some verification (blue mark,) which would make the process of spoofing from other wallets more difficult.


Unfortunately, some people can download fake apps such as, an application to enhance the security of electrum wallet by adding a fingerprint, an application to link electrum to your bank account, an application to make electrum's fees zero.

[ShowOff]

Since the OP didn't add the original Electrum image, I thought I would do it myself to avoid confusion for some newbie. I have been using the Electrum mobile wallet in the last few weeks as well as for PC. This wallet look quite generous with several advantages over my old wallet. I was advised to use Electrum because the fees I was charged for each transaction were too high on the old wallet. Over the course of using Electrum, I have saved even more transaction fee. This will be good to use as long as transaction fees increase. It's just that if we install the wrong Electrum application, maybe what will happen is loss of assets.

Do we need to report the fake Electrum application to Google for removal ?
So far I see 100+ users who have downloaded it.

Code:

The real Electrum.

[Peanutswar]

...verify everything before we click or download it we can ba save.

Still, there are some new members or new into the world of cryptocurrency will get curious about the use of the electrum wallet of course they are trying to search this on their Android or Apple store if this is available because it's more convenient to them having this kind of wallet. Some of them might get a doubt which one is legit or not. It's better if we keep enlightening up them.

.....
I was hoping that electrum's wallet would seek to obtain some verification (blue mark,) which would make the process of spoofing from other wallets more difficult.
...

Is this the same as the face book verification account (I'm not sure if this the right term)?
Example :


Well this might be a good idea, I hope they will adopt this too.

~~~

Will edit the thread and indicate this thank you. Its better if we reported this to prevent phishing too.

[Apostlekin$$$]

When it comes to money related applications like bank apps, crypto wallet apps etc always download them from official websites, using app stores to download such apps is called unofficial and it's not safe at all, apps like

1. Crypto wallet mobile apps
2. Bank account apps
3. Metamask add ons and other browser extensions

They must be downloaded through official websites only, be smart

[pooya87]

Actually this presents a pretty big issue; users can't possibly verify the hashes of APK (Downloaded from GPlay) and it doesn't make sense for most to sideload Electrum either. Guess this is a pretty good point to dissuade people from using a mobile wallet as their primary wallet.

users can download the .apk file from the Electrum.org website just like they download the desktop binaries and verify the signature (not hash) of the file that is signed using the same PGP key in the same manner. the .apk file can then be transferred to their phone and installed by executing it manually instead of downloading and executing through google play store.
for example the latest version links for arm-64 architecture are:

Code:

https://download.electrum.org/4.0.5/Electrum-4.0.5.0-arm64-v8a-release.apk
https://download.electrum.org/4.0.5/Electrum-4.0.5.0-arm64-v8a-release.apk.asc

[NeuroticFish]

users can download the .apk file from the Electrum.org website just like they download the desktop binaries and verify the signature

Indeed, this is the best option.
And for the lazy ones, also on electrum.org, near the Android downloads, there's the link to Google play for the correct wallet.

The most important rule is that (almost) anything else is better than blindly search on Google play.