Crypto wallet fraud and mobile app security: are controls keeping up?

TL;DR: Crypto fraud is rising 24% a year in the sector since 2020, and mobile apps now sit at the centre of the attack surface because attackers can inspect, modify, and run them on devices they control, according to Guardsquare’s analysis of Entrust and Chainalysis data. The governance gap is not encryption alone, but runtime trust, API attestation, and fraud-resilient mobile design.

NHIMG editorial — based on content published by Guardsquare: Your Crypto Wallet App Is a Target: Protect the Keys to Digital Value

By the numbers:

• Cryptocurrency fraud in the sector has grown 24% every year since 2020.
• Cryptocurrencies now account for 60% of all deepfake fraud cases.
• Nearly 80% of crypto projects fail to recover fully after a major hack.

Questions worth separating out

Q: What breaks when mobile KYC controls rely on client-side trust?

A: Client-side trust breaks when attackers can inspect the app, modify behaviour, or replay inputs before the verification decision is made.

Q: Why do mobile wallet apps increase fraud risk for crypto platforms?

A: They concentrate private keys, onboarding checks, and transaction approvals in one exposed interface.

Q: How can security teams measure whether mobile app attestation is working?

A: Look for blocked requests from repackaged clients, fewer anomalous device fingerprints, and lower success rates for scripted API abuse.

Practitioner guidance

• Inventory mobile-exposed secrets as governed credentials Find API keys, tokens, and certificate material embedded in mobile apps and treat them as non-human identities with owners, rotation dates, and revocation paths.
• Move trust checks off the client and into the backend Use attestation, device risk scoring, and server-side authorisation so the app cannot self-certify its own integrity or transaction legitimacy.
• Harden against reverse engineering and repackaging Apply obfuscation, tamper detection, and runtime protection where the app exposes sensitive logic, then verify that controls fail closed under debugging or instrumentation.

What's in the full article

Guardsquare's full article covers the operational detail this post intentionally leaves for the source:

• Specific examples of reverse engineering and runtime manipulation techniques used against mobile crypto apps
• Detailed descriptions of code hardening, RASP, and telemetry patterns for mobile app protection
• The fraud scenarios tied to clipboard hijacking, repackaged apps, and onboarding abuse
• Guardsquare’s implementation guidance for mobile API security and attestation

👉 Read Guardsquare’s analysis of crypto wallet fraud and mobile app security →

Crypto wallet fraud and mobile app security: are controls keeping up?

Explore further

View Full Forum →  |  NHI Foundation Course →