How to verify a wallet app is genuine

Why this is a real threat, not paranoia

Fake wallet software is one of the most reliable ways attackers steal crypto, because it defeats every downstream protection at once: a counterfeit app can capture your recovery phrase the moment you type it, or silently swap a destination address before you sign. Fakes appear as look-alike browser extensions, cloned mobile apps in official and third-party stores, sponsored search ads pointing at typo-squatted domains, and “support” that directs you to download a “fixed” version. MetaMask’s own guidance is blunt: there are only two genuine forms of the wallet — the browser extension and the mobile app — and “these are the only places you can sign transactions.”

Verifying genuineness is therefore not optional polish. It is the step that protects the seed phrase you are about to enter.

Start from the official source, reached deliberately

The most important habit is to reach the download from a source you navigated to yourself, not one that was presented to you. Type the official domain directly or use a bookmark you saved previously; do not click search ads, links in emails or DMs, or QR codes from untrusted contexts. Attackers routinely buy ads above the real result and register domains one character off the real one.

Once on the official site, use its own links to the app stores or extension stores rather than searching the store directly, because store search results include imitations. For a browser extension, confirm the publisher, the extension ID, and the user count against what the official site links to — a brand-new extension with few users and a slightly wrong name is a classic fake.

Checks that apply to any wallet

• Domain: inspect the exact spelling and top-level domain. Look-alikes substitute letters, add hyphens, or use unusual TLDs.
• Publisher identity: in an app or extension store, the developer/publisher name must match the official project. Report and ignore mismatches.
• It never asks for your seed phrase to “verify” or “sync”: a genuine wallet only takes the phrase during first setup or recovery, entered into the wallet itself. Any web page, popup, email, or support agent asking for it is an attack.
• Unsolicited contact is a red flag: MetaMask states its support team “never contacts you first” and does not handle cases over social media like Twitter, Telegram, Discord, or Instagram.
• Urgency and “security verification”: messages demanding an immediate “wallet verification” or “2FA verification” are engineered to rush you past these checks.

Cryptographic verification: signatures and checksums

For software distributed as a downloadable file — desktop wallets and, especially, hardware-wallet firmware — you can go beyond “trust the site” and cryptographically verify that the file is the one the developers published. Two mechanisms do this:

Checksums (hashes)

The project publishes the SHA-256 hash of the genuine file. You compute the hash of your downloaded file locally and compare. If they match, the file was not altered or truncated in transit. A checksum alone, however, only proves the file matches the published hash — if an attacker controlled the page, they could publish a matching hash for a malicious file. That is why the hash itself should be signed.

Digital signatures (PGP)

A signature proves the file came from the holder of a specific private key. Coldcard’s documented process is a good template: verify the OpenPGP signature on the published signatures.txt manifest, then compare the SHA-256 hash of the firmware against the hash inside that signed manifest. This confirms both that the hash list is authentic (the signature) and that your file matches it (the hash). Signature verification requires GPG tooling — GPG is included on Linux, GPG Suite on macOS, and Gpg4win/Kleopatra on Windows — and it depends on you trusting the correct signing key, obtained from an independent source rather than the same page as the download.

Hardware wallets: device authenticity is separate

For a hardware wallet, verifying the software is only half the job; you also verify the device. Ledger’s “genuine check” is a challenge-response attestation: Ledger’s server sends a challenge, the device’s secure element signs it with a key injected at the factory that never leaves the chip, and the server confirms the signature. This proves the secure element is genuine. Ledger notes an important limit — the check cannot detect physical tampering such as an added implant if the original secure element is intact — which is why buying directly from the manufacturer or an authorised reseller matters, and why a genuine device generates your recovery phrase itself and never ships with the phrase pre-filled.

A practical verification order

Browser extensions deserve extra scrutiny

Extensions are a favourite vector because they run inside the browser alongside every site you visit, and because store listings are easy to imitate. Before installing, confirm you reached the store page through a link on the official website. Check the publisher, the review count and history, and be wary of a listing that is new, has few users, or carries a name with an extra word or altered spelling. After installing, treat requests for your recovery phrase from any web page as hostile — a genuine extension does not ask a website for your phrase. Be cautious, too, about auto-updates and permissions: an extension that suddenly requests broad new permissions is worth re-checking against the official project.

Going further: reproducible builds

Some open-source wallets support reproducible (deterministic) builds, meaning independent parties can compile the published source and confirm they produce exactly the same binary that is distributed. Where this exists, it lets the community verify that the released app matches its public source code, not just that the file is signed. Most users will not rebuild software themselves, but the presence of reproducible builds and independent verification is a positive signal about a project’s transparency, and it complements the signature and checksum checks above rather than replacing them.

If something does not add up

Stop before entering a recovery phrase or approving a transaction. A mismatched hash, a failed signature check, a publisher name that is slightly off, an unexpected request for your phrase, or “support” that contacted you first are all reasons to close the app and re-verify from the official source. The cost of pausing is minutes; the cost of proceeding can be the entire wallet. Verification is a habit worth performing every time you install or update, not only on the first day — a compromised update channel is as dangerous as a fake first download.

Sources

• MetaMask Help Center — How do I recognise the real MetaMask?
• MetaMask Help Center — Is this email really from MetaMask?
• Coldcard — Verifying firmware signatures and checksums
• Ledger Donjon — Device genuineness threat model
• Ledger — Checking that your device has a genuine secure element
• ethereum.org — Security and scam avoidance