Researchers from the Check Point Research (CPR) team discovered malware hidden in an app on Google Play.

That app, WallConnect, had more than 10,000 downloads and stole about $70,000 in cryptocurrency from victims, until Google took it down. The WallConnect app has been on the Google Play Store since March 2024.

Legitimate WalletConnect was developed to facilitate the connection of decentralized applications (dApps) to crypto wallets. However, WalletConnect has some limitations as not all wallets support it, CPR said.

“Attackers have cleverly exploited the complications of WalletConnect and tricked users into thinking there is an easy solution – a fake WalletConnect app on Google Play,” the researchers said.

When victims download the malicious version, they are asked to link their crypto wallet, which directs them to a malicious website.

“Users must then verify the selected wallet and are asked to authorize certain transactions,” CPR explained.

“Each user action sends encrypted messages to the Command and Control (C&C) server, and the user’s wallet data, blockchain networks, and addresses are retrieved,” it said, among other things.

The malware is designed to grab the most expensive crypto-tokens first, before moving on to others.

“Only 20 users whose money was stolen left negative feedback on Google Play, indicating that there are many victims who may still be unaware of what happened to their money,” CPR warned.

Researchers say at least 150 users were scammed and their total loss exceeds $70,000. Given the difference between the number of victims and dismissals, it is possible that the fraudsters have also artificially inflated the number of dismissals.

Check Point researchers reported the fraudulent app to Google and it was removed from the Google Play Store.

Users should be more careful when linking crypto wallets to a platform or service, and carefully check each transaction before approving it.