New Shopping Snap Vulnerability: Domain Hijacking Attack Threatens Crypto Wallet Users

ResearchChadButBroke · 2026-02-04T21:00:57+00:00

Security researchers have revealed a serious threat to the Linux Snap Store, where hackers exploit expired developer domains to push malicious app updates, targeting popular cryptocurrency wallets and compromising users' digital assets. Users are urged to verify app authenticity and utilize official websites for installations.

ResearchChadButBroke

2026-02-04 21:00:57

Abstract generation in progress

Security researchers have uncovered a sophisticated threat targeting the Linux Snap Store, where attackers exploit expired developer domains to compromise legitimate applications. This domain resurrection attack allows hackers to seize control of previously registered domains and deploy malicious updates through official channels, making detection extremely difficult for end users.

The Attack Mechanism: How Shopping Snap Security Fails

The threat works by hijacking expired domains associated with trusted developers, then using these compromised credentials to push poisoned versions of popular cryptocurrency wallets including Exodus, Ledger Live, and Trust Wallet. Once installed through the official Snap store, the malicious applications appear legitimate but secretly capture users’ mnemonic phrases. Two confirmed compromised domains—storewise.tech and vagueentertainment.com—have already been weaponized in this manner. The Snap mechanism’s design flaw allows attackers to inject malicious code into previously trusted software without triggering user alerts, making this particularly dangerous for less technically-savvy users.

Why This Matters for Your Digital Assets

This attack represents a critical vulnerability in the Linux software distribution model. By targeting wallet applications directly, cybercriminals can bypass traditional security measures and gain direct access to cryptocurrency holdings. The affected wallets serve millions of users globally, meaning the potential impact scope is substantial.

Protecting Yourself

Users should verify application authenticity before entering sensitive information, regularly check their domain registrations for hijacking indicators, and consider using official wallet websites rather than store-based installations when possible. As the shopping snap ecosystem continues to evolve, ongoing security audits of the Snap Store’s verification protocols remain essential to prevent similar exploits.

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.