The Cardano community faces a new wave of phishing attacks as fraudulent wallet applications masquerading as the official Lace wallet appear on major mobile app stores. The deceptive apps, which closely mimic the branding and interface of Input Output Global’s Lace wallet, target unsuspecting ADA holders looking to manage their Cardano assets on mobile devices.
The Exploit Mechanics
The attack operates through a classic credential-harvesting scheme. The fake applications, distributed through both Google Play and Apple’s App Store, replicate the visual design of the legitimate Lace browser extension wallet. When users download the impostor app and attempt to import or create a wallet, the application captures seed phrases and private keys, transmitting them to servers controlled by the attackers. With Bitcoin trading at approximately $64,927 and the broader crypto market capitalization exceeding $2.5 trillion on April 21, 2024, the potential damage from compromised wallets is substantial.
The phishing apps exploit a timing vulnerability: Lace, developed by Input Output Global, exists primarily as a browser extension for desktop platforms. The absence of an official mobile version creates demand that scammers eagerly fill. The fake listings include convincing logos, screenshots, and descriptions that pass casual inspection by both users and app store review processes.
Affected Systems
The primary targets are Cardano (ADA) holders seeking mobile wallet functionality. ADA trades at approximately $0.50 on April 21, 2024, making it one of the top ten cryptocurrencies by market capitalization. The Cardano ecosystem, with its growing DeFi landscape and staking participation rate exceeding 70 percent, represents a significant pool of potential victims. Users who store ADA alongside other assets in multi-currency wallets linked to the same seed phrase face compounded losses.
Similar phishing campaigns have previously targeted popular wallets across multiple blockchains. The pattern extends beyond Cardano: fake MetaMask, Trust Wallet, and Phantom apps appear regularly on mobile stores. The Federal Trade Commission reports that cryptocurrency scams cost consumers over $1 billion in 2023, with phishing and impersonation schemes accounting for a significant share.
The Mitigation Strategy
Input Output Global responded swiftly by issuing a public security advisory through official channels, warning users that Lace currently has no mobile application. The team urged community members to report fraudulent listings to app store operators and shared verification guidelines. The Cardano Foundation coordinated with Google and Apple to expedite the removal of identified fake apps.
Security researchers recommend several protective measures: always verify the developer name and URL before downloading any wallet application, cross-reference official project websites and social media announcements, enable two-factor authentication on exchange accounts, and never enter seed phrases into any application without verifying its legitimacy through multiple independent sources.
Lessons Learned
This incident underscores a persistent weakness in the mobile app distribution ecosystem. Despite improvements in review processes, phishing apps continue to slip through, particularly during periods of heightened market activity. The post-halving environment of April 2024, with Bitcoin’s block reward recently reduced from 6.25 to 3.125 BTC, attracts new users who may lack the experience to identify sophisticated phishing attempts.
The attack highlights the importance of official communication channels. Projects that proactively clarify which platforms they support—and explicitly state which they do not—reduce the attack surface for their communities. The Lace team’s quick public response likely prevented significant losses.
User Action Required
Cardano users should immediately verify that any wallet application on their mobile device is legitimate. If you downloaded a Lace wallet app from a mobile store, assume your credentials are compromised: move your funds to a new wallet using a fresh seed phrase generated on a verified platform. Report suspicious listings to the relevant app store and to the Cardano community security channels. Always check the official Input Output Global website and verified social media accounts before installing any crypto wallet application.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before making financial decisions.
Lace having no official mobile app and fake ones sitting on app stores for days. this is a failure at every level, team should have been louder about it
seed_scare_ the real issue is app store review teams cant tell a real crypto wallet from a phishing clone. they need dedicated crypto reviewers or this keeps happening
IOG not pushing a banner immediately is the real failure here. every hour without a warning meant more ADA holders walking into the trap
IOG should have pushed a banner on their site the second they knew fake apps existed. took them way too long to respond publicly
Kojo M. IOG taking days to respond to an active phishing campaign targeting their users is genuinely negligent. a tweet takes 10 seconds
fake wallets on both stores simultaneously means organized effort not a lone scammer. someone built polished clones for iOS and android with matching branding. thats real investment in theft
Tomasz W. exactly this. polished clones on both stores with matching branding means a team built this, not some script kiddie. the investment in fakery is proportional to the ADA they expected to steal
fake lace wallets on the actual app store, not some shady apk. google and apple both missed this. makes you wonder what else is slipping through
google and apple both approved these fake Lace wallets. their review process is security theater if a phishing app can sit there for days harvesting seeds
phish_scanner_ both Google and Apple approved these. their review process for crypto apps is clearly inadequate. seed phrases on a fake app = instant drain
Ravi S. the team should have pushed community alerts across all socials the minute they knew. days of silence while fake apps harvested seeds is unacceptable
phish_scanner_ the worst part is apple approved it too, not just google. everyone blames android sideloading but these were store-listed
Apple and Google collectively process millions of app submissions. The issue is crypto wallets need specialized review that their teams simply don’t have the expertise for.
phish_scanner_ google and apple both missed it because their review teams cant distinguish a real crypto wallet from a phishing clone. they need domain-verified listings for financial apps or this keeps happening
seedfire_ domain-verified listings should be the minimum for any financial app. google and apple have no excuse at this point
literally downloaded one of these last year, luckily got suspicious before entering my seed. close call
close calls like this are why i triple check every wallet url now. almost lost my ada stack to a fake eternl clone back in 2022
The part about Lace not having an official mobile app is key. If you see a crypto wallet on the store that doesnt have a confirmed mobile release from the team, thats a red flag the size of a bus.
Dara Okafor nailed it. Lace explicitly said they had no mobile app and people still downloaded fakes. always verify with the official team first
Dara Okafor the no-mobile-app gap was the whole exploit vector. if IOG had shipped a mobile wallet on time these fakes would have had zero surface area
Dara Okafor Lace not having a mobile app was the whole opening. IOG took 18 months to even acknowledge mobile was needed. that gap is where the phishing attacks festered
Downloaded fake Lace wallet last year. Got suspicious before entering seed. Close call
Google and Apple process millions of apps. Crypto wallets need specialized review they don’t have expertise for
Triple check every wallet URL now. Almost lost ADA stack to fake eternl clone in 2022
Triple checking every wallet URL now – almost lost my ADA stack to a fake wallet clone last year.
Google and Apple both approving fake Lace wallets shows their review processes are inadequate for crypto apps.