You open your crypto wallet, see a pop-up saying "Version outdated, click to update", and tap it without thinking — this action could be the start of you losing all your crypto assets.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
At the end of 2025, security firm Kaspersky disclosed a phishing attack targeting Ledger hardware wallets: Attackers used SEO ads and fake airdrop pages to redirect users to counterfeit official websites. After users clicked "Connect Wallet", the page popped up a prompt saying "Enter your mnemonic phrase to verify identity", with an interface that looked identical to the official one. Some users saw this pop-up on a page redirected from the real Ledger domain, thought it was legitimate, and entered their 24-word mnemonic phrase. All assets in their wallet were drained within minutes.
Today we cover one critical topic: When your crypto wallet shows a pop-up upgrade reminder, how to judge if the installation package has been tampered with.
Step 1: Ignore the pop-up, check the official website manually
Goal: Confirm if there is a real official version update.
How to do it: Close the update pop-up inside your wallet. Manually type the official wallet website address in your browser (such as metamask.io, token.im, www.tokenpocket.pro), then check the "Download" or "Announcement" section on the official site to see the latest released version number.
Success check: The latest version number you see on the official website matches the version number shown in your wallet. If the official website has not released a new version, but your wallet pop-up says there is an update, the pop-up is fake — close it immediately.
Special note for Android APK users: After downloading the APK from the official website, do not install it directly. Do one extra verification step: check if the installation package is tampered with using a hash value verification tool. This is currently the most reliable anti-tamper method.
Step 2 (For Android Users): Verify with Hash Value, Match the Installation Package Fingerprint
Goal: Confirm that the APK installation file you have is exactly the same as the file officially released by the wallet team.
A hash value can be understood as the "digital fingerprint" of an installation package. Even if you modify just one single character in the installation package, the recalculated SHA256 value will be completely different. If an attacker decompiles the legitimate APK, injects code that steals your mnemonic phrase, and repackages it, the fingerprint will definitely change.
Step-by-step operation guide:
Download the APK installation package from the official website, save it to your computer desktop.
Open a free online hash calculation tool, such as
https://emn178.github.io/online-tools/sha256_checksum.htmlorhttps://oktools.net/file-hash.Drag and drop the APK file into the tool to get its calculated SHA256 value.
Go to the "Verification" page or help center of the wallet official website, find the official published SHA256 value for that exact version, compare every single character.
Success check: The SHA256 value you calculated is 100% identical to the official published value (make sure all characters, including upper and lower case, match). If they do not match, delete the installation package immediately, abandon all wallet addresses used with this tampered wallet, and re-download the file from the real official website.
Official SHA256 value lookup paths for common wallets:
imToken: On the official
https://token.im/downloaddownload page, or the SHA256 comparison table for all versions published in the help centerTokenPocket: On the official verification page
https://verify.tpwallet.io/
Common mistake: Many users skip hash verification, thinking "I downloaded it from the official site so it can't be fake". But scammers' common trick is to use SEO to push fake phishing sites to the top of your search results, so you think you are on the official site but you are not. The premise of "downloading from official site" is that the site you visit is actually the real official website.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
Step 3: Never Click Any Links Inside the Pop-Up, Bypass It Completely
Goal: Cut off the phishing risk path from the source.
How to do it: No matter what the pop-up looks like, no matter how urgent the tone is, do not click any button provided by the pop-up. If you need to upgrade, download the new version manually from the official website. If you need to confirm your account status, open the official App directly to check.
Success check: You complete the entire upgrade operation without relying on the pop-up at all. If you download the APK from the official website and pass the hash verification, your wallet is safe.
Risk Alert: Decentralized wallets (such as imToken, TokenPocket, MetaMask) will never pop up a prompt inside the App asking you for your mnemonic phrase or private key. Any prompt that says "you must verify your mnemonic phrase to complete the upgrade" is 100% phishing. The mnemonic phrase is the only key to your assets, never enter it on any website or App under any circumstances. The official wallet team will never ask for your mnemonic phrase for any reason.
Final verification after operation: The new version APK you downloaded from official website passes hash verification, opens normally after installation, and your asset balance and transaction history are exactly the same as before. If you are an iOS user, confirm that the developer name on the App Store matches the official name (for example, imToken's official developer is IMTOKEN PTE.LTD.).
Next recommended action: Bookmark your crypto wallet's official website in your browser. Next time you see an upgrade pop-up, directly open the bookmarked site to check official announcements. Spend 5 minutes finding the "Security Guide" or "How to Verify Your Wallet Is Legitimate" article in the wallet's official help center, and go through the official verification steps — this is far more useful than panicking and asking for help after you run into a scam.
