Cake Wallet - What to look out for!

[Obsidian Games]

Using Cake Wallet? What to watch out for, and whether a Ledger is the better choice

My experience
I lost $350 of Litecoin after funds ended up at addresses I never intended to send to. I haven't been able to prove whether the cause was the app itself, address poisoning, clipboard malware or a compromised seed, so I am not claiming that. But it pushed me to research this properly, and this is what I found.

TL;DR

• I found no public report of a current Cake Wallet bug that redirects outgoing sends. The one documented Cake flaw is old and Bitcoin-specific (details below).
• Redirected-send losses usually come from address poisoning, clipboard malware, leaked or weak seeds, or fake apps. These affect every wallet.
• Cake Wallet is a hot wallet with no comprehensive public third-party audit. Reasonable for small daily amounts, not ideal as your only storage for savings.
• Ledger is not immune either, and neither is any other hardware wallet (see Coldcard below). But a hardware wallet with on-screen address verification defeats the most common redirect attacks.
• It is not Cake versus Ledger. Cake supports Ledger, so you can use both together.

1. Cake Wallet: documented facts

The 2020-21 key generation flaw

• Versions before v4.1.7 generated 12-word Electrum-style SegWit Bitcoin wallets from a weak random number generator. The vendor disclosed it in May 2021 and patched it in v4.1.7.
• Milk Sad researchers traced about 548.9 BTC through 8,757 weak wallets between 2020 and 2024. Later drains were mostly sweeps of holders who never moved their coins.
• Monero wallets were not affected. The bug was only in the Bitcoin key path.
• Re-importing a weak seed into a newer Cake version, or into another wallet like Electrum, keeps it weak. A patched app does not repair an old seed.
• In December 2023 Cake merged a hashed list of known-weak seeds, so the app can warn users who still use them.

Audit and verification

• The code is open source (MIT), but multiple reviews state that no comprehensive third-party security audit covering the whole wallet has been published as of mid-2026. Cake says it audits internally, which is self-reported.
• WalletScrutiny lists it as source-available, not independently verified. iPhone apps cannot be reproduced from source at all.

Structural risks

• It is a hot wallet. If your phone is compromised, your funds are at risk.
• Wallet Groups lets one 12-word seed back Monero, Bitcoin, Litecoin, Solana, Ethereum, Bitcoin Cash, Nano and Tron. That is convenient, but one leaked seed exposes everything.
• In-app swaps and purchases run through third-party providers. A swap shows a provider deposit address that differs from your own, which is normal, but easy to confuse. Providers can also fail to deliver, and recovery is difficult.

2. Redirected sends: what actually causes them

• Address poisoning: attackers send dust from a look-alike address so it appears in your history, and you copy it by mistake. Carnegie Mellon documented 270 million attempts on Ethereum and BNB Chain between July 2022 and June 2024, targeting 17 million addresses. It is pure social engineering and works against any wallet.
• Checksums do not help. The attacker's address is valid. You just send to the wrong valid address.
• Clipboard hijacking: malware swaps the address you copied for the attacker's. This requires a compromised device.
• Scale: one victim lost about $69 million in WBTC after copying a poisoned address.
• Fake apps and phishing: anything asking for your seed phrase is a scam. Nobody legitimate will ever need it.

Defenses

• Never copy addresses from your transaction history. Use a saved address book or allowlist.
• Check the full address, not just the first and last characters.
• Send a small test transaction before large amounts.
• Verify the destination on a hardware wallet's own screen.
• Keep your device clean and install apps only from official sources.

3. Ledger: the honest pros and cons

Pros

• Signing keys stay on the device, with Cake or Ledger Live as the interface.
• You see the real destination address on the device screen, which defeats poisoning and clipboard swaps if you actually read it.
• Ledger's reported data breaches did not touch the secure element or seeds.

Cons

• 2020 customer data breach: reported as roughly 270,000 customers by some sources and over 1 million records by others. It led to years of targeted phishing, including threats.
• December 2023 Connect Kit supply-chain attack: malicious code in a Ledger JavaScript library drained roughly $484K from dApp users.
• January 2026 Global-e breach: customer contact and order data leaked via a payment processor. No seeds or funds were affected, but phishing letters impersonating the vendor followed.
• Ledger Recover (May 2023): an optional paid recovery service that started a long trust-model debate.
• "Certified" covers the hardware only. The software around it, fake Ledger Live apps and your own habits are still attack surface. Tampered devices with pre-filled seed cards also exist, so buy only from the official store.

4. Hardware wallets are not a guarantee: Coldcard, July 2026
This was Coldcard, not Ledger, but it matters for the comparison.

• On July 30, 2026, attackers drained over 1,000 Bitcoin addresses in about 41 minutes. The cause was a seed generation flaw, not a break in Bitcoin's cryptography.
• Reported totals grew over time, from about 594 BTC in the first reports to more than 2,000 BTC in later analyses.
• A firmware update does not fix a weak seed that already exists. Restoring it elsewhere keeps it weak.
• This is the same class of bug as Cake's 2021 flaw, but in hardware. Randomness failures can hit any vendor.

5. My conclusion

• Cake Wallet alone is fine for small, everyday amounts. For savings, use a hardware wallet bought from the official source, with the seed generated on the device.
• Best setup in my view: Cake (or any wallet app) as the interface plus a Ledger as the signer, always verifying the address on the device screen.
• For large holdings, add a passphrase or use multisig. Never re-import an old seed from a vulnerable version.
• Never type your seed into anything except the device or wallet you are restoring on.
• If funds go missing, record txids, app versions and timestamps right away. Don't guess the cause in public until you can prove it.

Sources

• Milk Sad research on Cake Wallet: https://milksad.info/posts/research-update-6/ | https://milksad.info/posts/research-update-9/ | https://milksad.info/posts/research-update-10/
• WalletScrutiny, Cake Wallet: https://walletscrutiny.com/mobile/com.cakewallet.cake_wallet/
• CryptoSlate Cake Wallet review: https://cryptoslate.com/crypto-wallets/cake-wallet-review/
• Solana Compass, Cake Wallet: https://solanacompass.com/projects/cake-wallet
• Cake Wallet Ledger docs: https://docs.cakewallet.com/get-started/restore/restore-wallet-from-hardware
• Cake Wallet Wallet Groups announcement: https://blog.cakewallet.com/cake-wallet-introduces-monero-wallet-groups-new-seed-formats-and-more/
• Address poisoning (Spark): https://www.spark.money/research/bitcoin-address-poisoning-attack-defense
• $69M WBTC poisoning case (The Defiant): https://www.thedefiant.io/news/hacks/poisoned-wallet-address-loses-usd70-million-in-very-suspicious-wbtc-transaction
• Ledger incident history: https://ryder.id/blogs/post/every-ledger-hack-since-2020-and-what-each-changed
• Ledger Global-e breach: https://bravenewcoin.com/insights/ledger-hardware-wallet-users-hit-by-third-party-data-breach
• Coldcard (The Block): https://theblock.co/news/defi/2026-07-30-coinkite-coldcard-mk3-warning-410235
• Coldcard (Privacy Guides): https://www.privacyguides.org/news/2026/08/03/nearly-1400-bitcoin-hacked-from-coldcard-wallets/
• Coldcard tracing (Crystal Intelligence): https://crystalintelligence.com/investigations/coldcard-exploit-tracing-stolen-bitcoin/

Not financial or security advice. Figures come from the linked sources and some change over time, so check them yourself. Corrections welcome.

[Charles-Tim]

If this is not AI, I hope it is not coming from Ledger.

Cake Wallet alone is fine for small, everyday amounts. For savings, use a hardware wallet bought from the official source, with the seed generated on the device.

I prefer a wallet setup on an airgapped device or a multisig wallet that its keys are generated on different devices.

For large holdings, add a passphrase or use multisig. Never re-import an old seed from a vulnerable version.

I will suggest the use of passphrase for every wallet generated, except if it is multisig and not a singlesig wallet. Passphrase is also possible on multisig wallet, but I do not think the increase security is necessary.

[Obsidian Games]

If this is not AI, I hope it is not coming from Ledger.

Cake Wallet alone is fine for small, everyday amounts. For savings, use a hardware wallet bought from the official source, with the seed generated on the device.

I prefer a wallet setup on an airgapped device or a multisig wallet that its keys are generated on different devices.

For large holdings, add a passphrase or use multisig. Never re-import an old seed from a vulnerable version.

I will suggest the use of passphrase for every wallet generated, except if it is multisig and not a singlesig wallet. Passphrase is also possible on multisig wallet, but I do not think the increase security is necessary.

this is not coming from ledger just my personal experiences.

And i agree with you completely on using airgapped devices and multisig wallets, can't be safe enough now a days.

[JeromeTash]

My experience
I lost $350 of Litecoin after funds ended up at addresses I never intended to send to. I haven't been able to prove whether the cause was the app itself, address poisoning, clipboard malware or a compromised seed, so I am not claiming that. But it pushed me to research this properly, and this is what I found.

So what exactly is the point of this post in the scam accusation board? You can't even conclusively tell us what happened, so why are you accusing Cakewallet? Maybe you lost your funds due to your reckless behaviour that you don't want to tell us, so I don't see how the wallet should take the blame.

If you have any proof that Cakewallet stole your funds, then you should post it here, or else this is a baseless accusation.

[ovcijisir]

I am also not sure why is this topic on scam accusation board. Maybe it would suit better in Wallet software board.

Also OP you didn't mention newest security breach that affected Ledger - hardware implants were found in Asian and Germany bought Ledger devices. The implant reads the seed phrase from the screen and sends it to server in Hong Kong:
https://www.zetter-zeroday.com/who-is-planting-backdoors-in-ledger-crypto-wallets/

[FinneysTrueVision]

Using Cake Wallet? What to watch out for, and whether a Ledger is the better choice

My experience
I lost $350 of Litecoin after funds ended up at addresses I never intended to send to. I haven't been able to prove whether the cause was the app itself, address poisoning, clipboard malware or a compromised seed, so I am not claiming that.

These are the only details that are relevant. We didn’t need a whole AI generated essay telling us all of Ledger and Coldcard’s problems. Coldcard doesn’t even support Litecoin, so you are getting off track from your main point.

We don’t know anything about what website you were swapping on, which deposit address you were given, where your funds were sent to and whether the receiving address has any history that can be analyzed. There really isn’t any way that anybody can help you get your funds back if you are clueless as to what happened.

[Obsidian Games]

My experience
I lost $350 of Litecoin after funds ended up at addresses I never intended to send to. I haven't been able to prove whether the cause was the app itself, address poisoning, clipboard malware or a compromised seed, so I am not claiming that. But it pushed me to research this properly, and this is what I found.

So what exactly is the point of this post in the scam accusation board? You can't even conclusively tell us what happened, so why are you accusing Cakewallet? Maybe you lost your funds due to your reckless behaviour that you don't want to tell us, so I don't see how the wallet should take the blame.

If you have any proof that Cakewallet stole your funds, then you should post it here, or else this is a baseless accusation.

I was using cake wallet out of the box , deposited some litecoin on it after a week of the clean install and after i deposited i immediately saw my LTC was send to another address which after i saw i contract support about this but they didnt really say much in terms of the cuase and told me only you can send it that way , in which did not..
So i delete the product and never tried it again , again it was only $350 , but for the normal people who don't have a lot of money , just wanted to make a post about it so they can know what to look out for.

[Obsidian Games]

I am also not sure why is this topic on scam accusation board. Maybe it would suit better in Wallet software board.

Also OP you didn't mention newest security breach that affected Ledger - hardware implants were found in Asian and Germany bought Ledger devices. The implant reads the seed phrase from the screen and sends it to server in Hong Kong:
https://www.zetter-zeroday.com/who-is-planting-backdoors-in-ledger-crypto-wallets/

Interesting , i probably forgot to add it or overlooked it , but yes pretty serious breach.

[Zwei]

I was using cake wallet out of the box , deposited some litecoin on it after a week of the clean install and after i deposited i immediately saw my LTC was send to another address

you didn't mention the date when this happened to you, because you mentioned some old vulnerability, and that would add context.
you also didn't mention the device/system you used the wallet on or where/how you installed it. was it on android, did you install it from play store, or did you download the apk, did you check if it was the real cake wallet, was your device compromised and you didn't know? etc...

So i delete the product and never tried it again , again it was only $350 , but for the normal people who don't have a lot of money , just wanted to make a post about it so they can know what to look out for.

money is money, and it sucks you lost your LTC, but if you are going to make a post about it, you've got to do it properly.

all i see is "i lost $350 using cake wallet, now see all this info on why you should use ledger", when ledger has its own problems.
besides the recent supply chain attack, you didn't mention that on their new devices they have the ability to extract your keys of the device for their ledger recover service.

and like the others have said, this doesn't belong on the scam accusation board, it's better suited on the wallet software board or the service discussion board.

[julerz12]

• I found no public report of a current Cake Wallet bug that redirects outgoing sends. The one documented Cake flaw is old and Bitcoin-specific (details below).

Are you suggesting there is a Cake Wallet bug that no one has reported yet, a bug that redirects outgoing sends? Do you have any proof of this bug?

I was using cake wallet out of the box , deposited some litecoin on it after a week of the clean install and after i deposited i immediately saw my LTC was send to another address which after i saw i contract support about this but they didnt really say much in terms of the cuase and told me only you can send it that way , in which did not..
So i delete the product and never tried it again , again it was only $350 , but for the normal people who don't have a lot of money , just wanted to make a post about it so they can know what to look out for.

So, because of this experience, you assumed there is a bug in that wallet, correct? Did you bother to ask if the app you downloaded was legit? Or if the device you're using isn't infected with malware?
I mean, reading your entire thread, you've already listed the possible reasons that your LTC got sent to another address. My guess: either someone accessed your secret recovery phrase, you downloaded a fake app, or, as you said, it was clipboard hijacking.

[Somegory]

My experience
I lost $350 of Litecoin after funds ended up at addresses I never intended to send to. I haven't been able to prove whether the cause was the app itself, address poisoning, clipboard malware or a compromised seed, so I am not claiming that. But it pushed me to research this properly, and this is what I found.

So what exactly is the point of this post in the scam accusation board? You can't even conclusively tell us what happened, so why are you accusing Cakewallet? Maybe you lost your funds due to your reckless behaviour that you don't want to tell us, so I don't see how the wallet should take the blame.

If you have any proof that Cakewallet stole your funds, then you should post it here, or else this is a baseless accusation.

The message already have the answer, he said he lost $350 worth of Litecoin after funds ended up in a address he never intended to send to, that says a lot, he made the mistake either through clipboard malware or his own mistakes.

He already said what happened, maybe I missed something but what he said never had anything to do with him putting the blame on cake wallet, you are free to put me on if I missed a part.

I am using cake hot wallet for small transactions and I am loving it so far.