Spot the Fake: A Field Guide to HashPack Phishing Clones Before They Empty Your Wallet
Photo: Mohamed Hassan, CC0, via Wikimedia Commons
Somewhere out there right now, a website looks almost exactly like HashPack. Same colors, same friendly mascot energy, same buttons in the same places. It wants your recovery phrase, and if you're not careful, it'll get it.
Phishing is the oldest trick in the crypto scam book because it keeps working. And as HashPack has grown into the go-to wallet for Hedera, the copies have multiplied. The good news: fakes almost always give themselves away if you know what to look for. This guide breaks down how the scams work and gives you a five-point inspection you can run in under a minute.
Why Hedera Users Are a Target
Scammers follow money and, more importantly, follow trust. Hedera's community is tight-knit and welcoming — great for onboarding, but it also means newcomers arrive eager to connect and quick to click. A fresh HashPack user searching for the extension or a dApp link is exactly who a phishing kit is built to catch.
The scams come in a few flavors:
- Fake download pages that mimic the Chrome Web Store listing and serve a malicious extension.
- Clone sites that look like hashpackwallet.net or a popular Hedera dApp and prompt you to "import" your wallet.
- Fake signing prompts that pop up while you're browsing, asking you to approve a transaction that actually drains your account.
- Imposter support accounts on X (Twitter), Discord, and Telegram offering to "help" you recover a stuck transaction — for your seed phrase.
The Anatomy of a Fake
Most phishing clones follow a script. They get you there through a sponsored search ad, a reply on social media, a Discord DM, or an email about a fake airdrop. Then the page applies pressure: limited-time claim, account verification required, wallet needs to be "re-synced."
The kill shot is always the same — a field asking for your 24-word recovery phrase or a private key. Real HashPack will never ask for those in a browser form, an email, or a chat. Ever. The moment a website requests your seed phrase, you're done: close the tab, no exceptions, no matter how official it looks.
If the fake is an extension instead, the scam flips. Instead of taking your phrase, it collects it — a lookalike wallet that generates real-looking addresses but logs everything you type and ships it to the scammer's server.
The Five-Point Inspection Checklist
Run this before you download, connect, or sign anything.
1. Read the URL character by character. Scammers rely on lookalike domains: hashpack-wallet.net, hashpackwallet.io, hashpackwallet.net, haşhpack.com with a sneaky character swap. Bookmark the real sites and the official Chrome Web Store listing once, then only ever arrive by bookmark — never by ad, link, or search result. Check for the padlock, sure, but remember HTTPS just means encrypted; scammers get certificates for free.
2. Verify the extension publisher. In the Chrome Web Store, click the developer name. The genuine HashPack extension is published by the HashPack team with a consistent listing history, real user reviews, and a large install base. A listing that's days old, has a generic publisher name, or a handful of reviews is a hard no.
3. Scrutinize every signing prompt. When HashPack asks you to approve a transaction, read what it actually says — which account, what token, what smart contract. Scam prompts often request approval for token associations or unlimited spending allowances you never intended. If a prompt appears out of nowhere, on a site you weren't interacting with, reject it.
4. Interrogate the urgency. "Claim expires in 10 minutes." "Your wallet will be deactivated." "Verify now or lose access." Legitimate crypto software doesn't operate on countdown timers and threats. Pressure is the product. The more a page rushes you, the more you should slow down.
5. Cross-check the channel. Before connecting to any Hedera dApp, confirm the link from an official source — the project's documented website, its verified X account, or a reputable aggregator. And treat anyone who slides into your DMs offering support as hostile by default. Real support teams won't ask for your phrase, your private key, or a "validation fee."
What To Do If You Slipped Up
It happens to sharp people too. If you entered your recovery phrase on a sketchy site or installed a bad extension:
- Act fast. Create a brand-new wallet with a fresh recovery phrase on a verified HashPack install.
- Move everything — HBAR, tokens, and any NFTs — to the new wallet immediately. Scammers often wait a few hours or days, so speed matters.
- Revoke token approvals on the old account using a Hedera approval-revoking tool so nothing can still spend from it.
- Report it to the FTC at ReportFraud.ftc.gov, the platform hosting the scam, and relevant Hedera community channels so others get warned.
If you only installed a suspicious extension but never typed your phrase, uninstall it, run a malware scan, and change passwords on anything you used while it was active — then still consider rotating to a fresh wallet if you signed anything unusual.
Build the Habit, Not the Fear
The goal here isn't paranoia — it's muscle memory. Bookmark the real sites. Read prompts like you'd read a contract. Treat your 24 words like the master key to your house, because that's exactly what they are. Run the five-point check a few times and it becomes automatic, the same way you glance at the license plate before getting into a rideshare.
The fakes are getting better, but they still run on the same fuel: haste and trust. Slow down for sixty seconds, and you'll be the one holding your HBAR — not somebody's phishing server.
