How to Verify a Bitcoin Wallet or Exchange Is Legitimate
Being able to download something from the App Store feels like a safety check has already happened. For Bitcoin apps, it hasn't. Here's how to actually check.
The App Store is not a safety guarantee
Sparrow Wallet is one of the more respected Bitcoin wallets in the world. It has never had an iOS app. It only runs on Windows, macOS, and Linux. And yet fake “Sparrow Wallet” apps have been appearing on Apple's App Store since 2023, more than a dozen of them. Sparrow's actual developer warned Apple as early as January 2024. The fakes kept coming back. In late July 2026, three people who together lost $1.8 million to one of these fake apps sued Apple, alleging Apple kept the app listed even after a theft had already been reported.
Sparrow isn't the only one. A convincing fake of Wasabi Wallet has circulated with an App Store listing that doesn't match Wasabi's real developer, zkSnacks. Fake Trezor apps have done the same thing. None of these needed to break any encryption. They just needed someone to type their seed phrase into the wrong app.
The takeaway: Apple reviewing and approving an app is not proof that the app is who it claims to be. That check is still yours to do, every time, no matter how established the name looks.
Five checks before you trust any wallet or exchange app
- Start from the project's own website, not an App Store search. Go to the wallet or exchange's official site first and follow its own link to the app, if one exists. Some well-known Bitcoin tools, like Sparrow, don't have a mobile app at all, which makes any mobile listing for them an automatic red flag.
- Check who the App Store says built it. Every App Store listing shows a developer or seller name. Compare it against the developer named on the project's own official site. A mismatch, or a name you can't find anywhere on the real project's site, is disqualifying.
- Favor projects that are open source. It means the code is public and independent people can (and do) review it. You don't have to read the code yourself for this to help; the fact that others can is what keeps projects honest.
- Look past the star rating. Ratings and reviews can be bought or faked. Read a handful of the actual written reviews, specifically for anyone warning that the app isn't affiliated with the real project. That warning, when it exists, is usually the most reliable signal on the whole page.
- Never type your seed phrase into anything you haven't already verified. This is the one that actually protects you if the first four checks somehow fail. A fake app only works if you hand it your words. If you're not certain of an app's identity, don't restore or create a wallet in it, full stop.
Categories to know, not brands to trust blindly
The names below are starting points for understanding what each category looks like in practice, not endorsements. Run every one of them, and anything else you're considering, through the five checks above before you trust it.
Buying Bitcoin
Exchanges like Cash App, River, and Strike are common starting points for actually acquiring Bitcoin. They're custodial, meaning they hold the keys while your Bitcoin sits there, which is fine for the moment of buying but not a long-term home.
Learning with small amounts
Self-custody apps like Aqua and Radar are examples of lighter-weight wallets people use to practice sending, receiving, and holding their own keys, while the amount involved is still small enough that a mistake would only sting, not devastate.
Protecting larger amounts
Once an amount would genuinely hurt to lose, people typically move toward a hardware wallet (Trezor and Bitkey are examples), a collaborative custody service that splits keys across multiple parties (Casa and Unchained are examples), or an institutional custody option (Fidelity is an example). Which shape fits you depends on how hands-on you want to be, and none of them replace doing the five checks above yourself.
Start small, stay calm, move up slowly
The safest way to learn any of this is with an amount that wouldn't hurt to lose. Send it, receive it, restore a backup, get comfortable with how it actually feels to move Bitcoin around, before you trust any single setup with something bigger. Rushing is how people skip the checks above; a small amount buys you room to be careful.
For more on layering your defenses as the amount grows, see Self-Custody: Holding Your Own Keys and Entropy and Bitcoin Security.
Common questions
Does being on the App Store mean a wallet app is safe?
No. Sparrow Wallet has no iOS app at all, yet fake versions have appeared on Apple's App Store since 2023, and three people lost a combined $1.8 million to one before Apple removed it. “Available on the App Store” confirms Apple approved a listing, not that the app is who it claims to be.
Can I trust an app's star rating?
Not on its own. Ratings and reviews can be bought or faked, and a fake app can accumulate a plausible-looking rating before enough people notice. Written reviews are more useful than the star count, especially ones warning that the listed developer doesn't match the real project.
Are the apps and services named on this page recommendations?
No. They're starting points to help you understand what each category looks like in practice, named because a beginner has to start somewhere. Run every one of them, and anything else you consider, through the checks on this page before you trust it with real money.
What's the single most important rule?
Never type or restore your seed phrase into an app or website unless you are already certain of its identity. A convincing clone doesn't need to hack anything if you hand it your seed phrase directly.