SlowMist Exposes Snap Store Exploit Targeting Crypto Users

Crypto News Exploits

SlowMist Uncovers Snap Store Exploit Targeting Crypto Users

Written by Aaron S.,

Editor-In-Chief

Last Updated: January 21, 2026

Key Takeaways

Attackers hijacked Snap Store developer accounts by re-registering expired domains and used them to spread fake wallet apps;
The malicious apps mimic real crypto wallets like Exodus, Ledger Live, and Trust Wallet to steal recovery seed phrases;
SlowMist confirmed that two Snap Store publisher domains were compromised.

Stop overpaying - start transferring money with Ogvio. Sign up, invite friends & grab Rewards now! 🎁

SlowMist Uncovers Snap Store Exploit Targeting Crypto Users

BITDEGREE IN YOUR SOCIAL FEED

Blockchain security company SlowMist has reported a new security issue affecting Linux users.

Attackers are using trusted apps on the Snap Store to collect crypto wallet recovery phrases and steal funds.

According to SlowMist’s chief information security officer, 23pds, the attackers are taking over Snap Store publisher accounts by registering expired domains. These accounts, once controlled, are then used to push fake updates through official channels.

What is Ethereum & What is it Used For? (Animated Explanation)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe - We publish new crypto explainer videos every week!

The fake apps are made to look like real crypto wallets, including Exodus, Ledger Live, and Trust Wallet.

When users install or update the app, they are asked to enter their wallet recovery phrases. The attackers then capture these details and gain access to the users’ funds.

SlowMist explained that the attackers monitor developer accounts linked to domains that have expired but were once legitimate. Once the domain becomes available, they register it and use email addresses tied to that domain to reset the account password.

After gaining access, the attackers can add harmful code through normal software updates instead of creating new apps, which helps them avoid suspicion.

SlowMist confirmed that two publisher domains, “storewise[.]tech" and “vagueentertainment[.]com", have already been compromised.

CertiK traced about $63 million in Tornado Cash deposits linked to the $282 million crypto wallet hack on January 10. What did the blockchain security firm say? Read the full story.