A clone of a real crypto exchange’s app can look identical to the original — same logo, same layout, same login screen — while quietly sending every deposit straight to a scammer’s wallet. Because the fake mirrors something the victim already trusts, the usual “does this look legitimate” check doesn’t catch it. Here’s how these clones get distributed and how to verify you’re using the real thing.
How the Scam Works
Step 1: The Distribution
Clone apps typically spread through paid social media ads, direct messages, or a link shared in a group chat — rarely through an official app store search, since major stores screen for this. Some are sideloaded APK files (Android) sent directly, bypassing store review entirely. Others use a typosquatted website with a domain just one letter off from the real exchange.
Step 2: The Convincing Interface
The clone copies the real exchange’s branding, login flow, and even customer support chat widget. After “signing up,” the user sees a dashboard showing a balance — but this balance is just a number in the clone app’s own database, unconnected to any real exchange or blockchain.
Step 3: The Deposit
The user deposits crypto to a wallet address shown in the app. That address belongs to the scammer, not the real exchange. The clone’s dashboard immediately updates to show the “deposited” funds, reinforcing the illusion that everything is working normally.
Step 4: The Withdrawal Block
When the user tries to withdraw, the app either fails silently, demands a “withdrawal fee” or “tax” paid separately first, or simply stops responding. By this point, the deposited funds are already gone — there was never a real account behind the interface.
A Composite Example (Illustrative, Not a Real Case)
Imagine someone clicks a social media ad for what looks like a well-known exchange’s app, offering a sign-up bonus. The ad links to a page prompting an APK download rather than the usual app store. The installed app looks identical to the real exchange, down to the color scheme and menu layout. After creating an account and depositing a modest amount, the dashboard shows the deposit plus a small “welcome bonus,” encouraging a larger transfer. When the user later tries to withdraw the full amount, the app displays a message requiring a “security verification deposit” to unlock withdrawals. After sending that as well, the app stops loading account data entirely. This scenario is a composite built from commonly reported patterns — it does not describe a real person, app, or event.
Red Flags That Get Missed
- The app was downloaded from a link or ad, not found by searching the official app store directly.
- An APK file was sent or downloaded outside of Google Play or the Apple App Store.
- The website domain has extra letters, hyphens, or a different extension than the real exchange’s known domain.
- A “bonus” or promotional deposit is offered for signing up through a specific link.
- A withdrawal requires paying a separate fee, tax, or “verification deposit” first.
- Customer support is only reachable inside the app itself, with no way to verify it through the real exchange’s official channels.
How to Protect Yourself
- Only download exchange apps from the official Google Play or Apple App Store, found by searching directly rather than clicking a link or ad.
- Type the exchange’s URL manually or use a bookmark you created yourself, rather than clicking links from ads, DMs, or group chats.
- Test with a small withdrawal before depositing significant funds on any account, especially a newly created one.
- Enable two-factor authentication on your real exchange account, which clone apps typically can’t replicate correctly.
- Check the app’s publisher name, review count, and review dates in the store listing — a low review count or a publisher name that doesn’t match the real company is a warning sign.
- Never pay a fee to unlock a withdrawal. Legitimate exchanges don’t require payment to release funds already in your account.
If You’ve Already Deposited Funds Into a Clone App
Stop sending any further funds immediately, including any requested “fee” to unlock a withdrawal. Preserve every record you can: transaction hashes, the wallet address you sent to, screenshots of the app, and the ad or link that led you there. If you paid via a card or bank-linked service at any point, contact that provider as well. Report the clone app to the real exchange it impersonated (most have a fraud-reporting channel) and to the app store if it’s still listed, in addition to your national fraud authority.
Report to your country’s official cybercrime or fraud authority:
- United States: FBI Internet Crime Complaint Center (IC3) — ic3.gov
- United Kingdom: Action Fraud — actionfraud.police.uk or reportfraud.police.uk (0300 123 2040)
- Canada: Canadian Anti-Fraud Centre — antifraudcentre-centreantifraude.ca, report at reportcyberandfraud.canada.ca
- Australia: Scamwatch (National Anti-Scam Centre / ACCC) — scamwatch.gov.au, report at scamwatch.gov.au/report-a-scam
If you’re outside these countries, search for your national police cybercrime reporting unit or financial regulator — most countries now have a dedicated online reporting channel.
Frequently Asked Questions
How can I verify an exchange app is genuine before downloading?
Search for the exchange by name directly in the official app store rather than clicking any link, check that the publisher name matches the company exactly, and compare the app’s review count and history against what you’d expect for a major exchange. When in doubt, check the exchange’s official website for a direct link to its verified app listing.
Can a clone app pass antivirus or app store screening?
Sideloaded APKs bypass app store screening entirely, so antivirus software is the only check in that case and isn’t always reliable against a well-made clone. Apps that do make it into official stores are usually removed once reported, which is why downloading directly from the store search (rather than an old link) reduces risk.
Is my money recoverable if I sent crypto to a clone app’s wallet?
Recovery is difficult since crypto transfers are generally irreversible and the receiving wallet is controlled by the scammer. Reporting to the real exchange, your bank if a card was involved, and your national fraud authority is still worthwhile, since it can support broader investigations even when individual recovery isn’t likely.
Why did the fake app’s dashboard show my deposit had grown in value?
The balance shown in a clone app is just a number stored in the scammer’s own system, unconnected to any real exchange or blockchain, so it can display any figure the scammer chooses. It has no relationship to funds actually being held or invested anywhere.
Does two-factor authentication protect me from clone apps?
It doesn’t stop you from installing a fake app in the first place, but it does add a layer of protection on your real exchange account, and a clone app typically can’t properly replicate your real account’s 2FA setup — which can be a useful sanity check if something about the login flow feels off.
Browse more resources in our Scam Awareness category.