Blockchain security experts have uncovered a fake mobile app that stole over$1.8 million in cryptocurrency. The app, called BOM, targeted users by gaining access to their private wallet data, including mnemonic phrases and private keys. Once installed, BOM deceptively requested unnecessary permissions, such as access to photos and media, which raised suspicion among security experts. When granted, the app scanned the device's storage, stole wallet data, and sent it to a remote server.

The first signs of unauthorised transactions were detected on 14 February, with further investigation revealing the scale of the theft. Over 13,000 victims had their funds stolen, with the hacker address traced across several blockchains, including Ethereum, BNB Chain, and Polygon. The stolen assets included Tether, Ethereum, Wrapped Bitcoin, and Dogecoin.

Though the identity of the attackers remains unclear, analysts from SlowMist noted that the app's backend services had gone offline, indicating the perpetrators may already be attempting to cover their tracks. Some of the stolen funds were exchanged through decentralised platforms like PancakeSwap and OKX-DEX, making it harder to trace the movement of the assets.

.