Monero Wallet Phishing: How to Spot a Fake Wallet in 60 Seconds

Monero wallet phishing is when a fake wallet site, app or support agent tricks you into typing your 25 recovery words, so the scammer can empty your wallet. You can protect yourself with one rule and a 60-second routine. The rule: a real wallet never asks you to enter your words to verify, sync or validate anything. The routine is below.

How the scams work

There is no clever hacking in most of these cases. The scammer makes something that looks right, gets you to type the words into it, and takes the money using the very same words. They are built to look boring and helpful. The patterns below are the ones that security researchers and wallet teams have documented.

• Look-alike websites. A page copies the design of a wallet or of the Monero project's site and offers buttons like "Import wallet" or "Restore". Every button leads to a box that asks for your words. One security site reported a fake that imitated getmonero.org in this way (its report is not strongly sourced, so we do not name the domain).
• Fake apps. A researcher documented a fake Android app, "My Monero - XMR", that copied the look of MyMonero's login screen. It sent whatever keys you typed to a remote database, then showed you a dashboard so you thought it had worked. See the write-up by SerHack.
• Search ads. Paid ads can sit above the real result. Security firm Scam Sniffer linked ads on Google and X to a wallet-draining service blamed for about $59 million in crypto losses in 2023, and reporting on it is summarised by Gulf News. That campaign targeted other crypto sites, but the trick is the same for any wallet name.
• Tampered downloads. In November 2019 the official Monero site briefly served compromised command-line wallet files. The project's own warning says anyone who downloaded in that window should check the hashes and not run files that fail. Reporting at the time said the changed files sent wallet seeds to an attacker. It was caught because a user noticed a hash mismatch. This is why verifying a download matters.
• "Validate your wallet" messages. Emails and posts say your wallet needs to be validated, synced or upgraded, and send you to a page that asks for your recovery phrase. Security blogs such as GridInsoft describe this as a recovery-phrase phishing scam, not a real security check.
• Fake support. You ask for help on social media. An account that looks official replies fast and asks for your words to "confirm" you are the owner. Real support never needs your recovery words, for any wallet. Former Exodus Monero users are an obvious target now that Exodus has dropped XMR; our guide to getting your Monero out of Exodus shows the safe route.
• Fake balance checkers. A site promises to show your Monero balance if you paste your seed or spend key. A real balance check never needs either: at most a view key, which cannot spend. See how to check a Monero balance safely.

Some of these examples are about other coins, and we say so where they are. The method never changes, because in every crypto wallet the words are the money.

Fake sites after the MyMonero shutdown

MyMonero announced its sunset in October 2025 and went offline on 6 January 2026. Its own site now says the service is closed. That left a lot of people searching for a place to restore, which is exactly the situation scammers like. We found a forum post from a user who says they entered a key on a look-alike MyMonero domain and lost funds. We cannot verify that single report, which is why we do not name the domain, but it fits the pattern above.

If you are a former MyMonero user, our guide to restoring a MyMonero seed shows exactly where to restore a 25-word or 13-word phrase and what to avoid. For the bigger picture of what to use now, see the MyMonero alternative page.

The 60-second check

Run through these five steps any time you are about to type your words anywhere, including here.

1. Where did you come from? A bookmark you made yourself, or an address you typed? Good. An ad, a message, a post or an email? Stop and go to a bookmark instead.
2. Read the address. Letter by letter, from the first character to the first single slash. Look for extra words, swapped letters, odd endings. A padlock only means the connection is encrypted, not that the owner is honest.
3. What is it asking for? You should only ever enter your words when you restore into a fresh wallet that you opened yourself. If a page asks for them to verify, sync, validate, claim, upgrade or fix something, close it.
4. Is it a download? Get it from the project's official page, and check its hash before opening it (see below).
5. Is someone rushing you? Urgency, prizes, support that finds you first, and requests to move to a private chat are all signs of a scam.

Red flags checklist

• It asks for your 25 words (or private keys) anywhere except a restore screen you opened yourself.
• It claims your wallet needs to be "verified", "validated", "synced" or "upgraded".
• You reached it through an advertisement, a direct message, a comment or a link in an email.
• The address has extra words, different spellings or an unusual ending.
• A "support agent" contacted you first, or asks you to share your screen or your words.
• An app in a store has a copied name and icon, very few reviews, and a support email that does not match the real project.
• It offers to double your Monero, give you free coins, or recover a lost wallet for a fee.
• You cannot find the project's source code, a clear team, or a documented way to check downloads.

Real wallet versus scam

If you want a broader look at wallet safety, see is Monero safe and the Monero wallets guide.

How to verify an official download

If you install software instead of using a browser wallet, you can prove the file is exactly what the project published. The Monero project explains this in its guide to verifying binaries. In simple terms:

1. Get the project's signing key and check that its fingerprint matches the one printed in the official guide. If it does not match, stop.
2. Download the list of file hashes (a hash is a short fingerprint of a file) and check that the list is signed by that key. A "good signature" means the list is genuine.
3. Work out the SHA-256 hash of the file you downloaded, without opening it, and look for it in the verified list.
4. No match means do not run the file. Delete it and download again from the official page.

The signature check is the step that matters, because it does not depend on which website you got the list from. The official guide says the verification should be done before you extract or use the software. This is also what protected people in 2019: the compromise was found because a hash did not match.

If you already entered your words

If you typed your words into something you now doubt, assume they are stolen. This is hard to hear, but it is the useful way to think about it. A seed phrase cannot be changed or secured after it leaks. The wallet it opens will always be reachable by anyone who has the words. You cannot lock it. What you can do is move your money out before the thief does.

1. Stop typing. Close the page. Do not enter anything else, and do not follow instructions from anyone offering to help.
2. Use a clean device. If you installed a file from an unofficial source, assume that computer is not safe. Use another device you trust.
3. Create a new wallet with new words. Do not restore the old phrase. Write the new words down on paper, and check them. See how to back up a Monero wallet.
4. Copy the new address and check it with the address validator.
5. Send everything to the new address. Restore the old words in a wallet you trust, and move all of the balance to the new wallet in one go. Monero payments take about 20 minutes (10 confirmations) to become spendable, so be patient and keep going.
6. Retire the old words. Never use them again. If you reused the same phrase anywhere else, treat that wallet as compromised too.

How MonkStash helps

MonkStash is a free web wallet, and we try to make phishing harder, not easier.

• Bookmark it. Open the wallet once from this site and check that your address bar says wallet.monkstash.com, then save it. Use the bookmark from then on.
• We never ask for your words outside the wallet screen. Not by email, not in a chat, not on a support form. If anyone claiming to be us asks, it is not us.
• Your keys stay on your device. The words are used locally and encrypted with your password. There are no accounts and no tracking on wallet pages.
• No extension yet. A MonkStash browser extension is planned but not built, so any "MonkStash" extension in a store today is fake.
• The code is open source. Anyone can read what it does (BSD-3-Clause). Open code does not stop a copycat site from running a changed copy, so the address bar check still matters most.

MonkStash is an early preview and has not been independently audited. That is another reason to start with a small amount. Questions? See the FAQ or support, and never include your words in a message.

What to do next

Bookmark your wallet today, so you never rely on a search result again. If you are unsure what the recovery words really do, read the Monero seed phrase explainer. If you used MyMonero, follow the restore guide, and compare your options in the MyMonero alternative page.