Security Alert: Beware of Scams Involving Counterfeit Hardware Wallets and Fake Apps – imKey Support

🚨 1-Minute Security Check

Stop using the device immediately if any of the following applies:

[ ] Cannot connect to the official app: The device cannot pair with the official imToken app.

[ ] No activation process after startup: After selecting a language during the first startup, the device immediately displays the options to create or recover a wallet. Genuine imKey devices must be activated before first use. Watch the official unboxing video for the complete setup process.

[ ] The manual contains a QR code for downloading an unofficial app: The manual instructs you to scan a QR code to download the imToken app, but the resulting link does not direct you to the official imToken website: https://token.im.

[ ] Abnormal SN code or firmware version: The SN code cannot be verified on the imKey website and returns the message “No device information found,” or the firmware version displayed on the device is newer than the latest version officially released on the imKey website.
Learn how to verify an SN code on the imKey website.

1. Background and How the Scam Works

Recently, the imKey team received user reports and confirmed the emergence of a new type of scam involving counterfeit hardware wallets used together with fake apps.

Unlike previous attacks that relied primarily on social engineering—see Security Alert: Beware of Social Engineering Scams—this scheme uses highly convincing counterfeit hardware devices, packaging, manuals, and setup procedures to lower users’ guard.

Victims are guided into an environment fully controlled by the attackers, where they are instructed to create or recover a wallet. The attackers can then steal the recovery phrase and ultimately transfer the victim’s assets.

The attackers use different tactics depending on the target:

For new users: They instruct users to scan a QR code printed in a counterfeit manual, download a fake app, and pair it with the counterfeit device.

For existing users: Because the counterfeit device cannot connect to the genuine imToken app, attackers instruct users to “uninstall the official app and install another app,” forcing them to pair the device with a malicious application.

⚠️ Risk Warning:
Hardware wallet security depends on four essential conditions: an official purchase channel, a genuine device, the official app, and activation performed personally by the user.

Any request to uninstall the genuine imToken app or scan a QR code in a manual to download an unofficial application is a scam. Stop the operation immediately.

2. How to Identify Genuine and Counterfeit Devices

Use the following table to thoroughly verify any new device in your possession:

Verification Item	Genuine imKey Device	Counterfeit Device Identified in This Incident
Purchase channel	Purchased from the imKey official website or an officially authorized store. Visit https://imkey.im for details.	Purchased from an unauthorized third-party seller. ⚠️ None of the stores currently selling imKey devices on JD.com are authorized, and purchases from these stores may be risky.
SN code uniqueness	Each device has a unique SN code that can be verified on the official website, where its activation status can also be viewed.	The SN code cannot be found on the imKey website, and the page displays “No device information found.”
First-time setup	The device must be activated before a wallet can be created or recovered.	After selecting a language, the device immediately displays the options to create or recover a wallet, with no activation process.
Firmware version	The latest official firmware version is v1.9.05.	Displays a fabricated firmware version, such as v1.9.08.
App pairing test	Can pair normally with the genuine imToken app via Bluetooth.	Bluetooth pairing with the genuine imToken app fails. The device can only connect to the fake app downloaded through the QR code in the manual.
Desktop software connection	Can connect normally to imKey Manager.	Displays a “USB connection error” message.
Appearance and details	The back of the latest devices features a laser-engraved “Verify Device” QR code.	No SN verification QR code is present on the back of the device.

3. Five Essential Security Rules

1. Purchase Only Through Official Channels

Do not purchase an imKey device from any third-party store that is not listed on the official imKey website.

Official website: https://imkey.im
Authorized store in China: Youzan Store
Authorized reseller verification: Official List of Authorized Stores

⚠️ Unauthorized Channel Warning:
None of the stores currently selling imKey devices on JD.com are authorized by imKey. These purchases may involve significant risks. Do not purchase from these stores.

2. Verify the SN Code and Activation Status Before Use

Before creating a wallet, verify the device through the official imKey verification page.

🔗 Verify an imKey SN Code

3. Download Apps Only Through Official Channels

Never scan a QR code on the packaging, in a manual, or provided by customer service to download an unofficial application.

Manually enter and visit the official imToken website:

Official imToken website: https://token.im

App Store: The iOS version is available only outside mainland China. Confirm that the developer listed in the App Store is IMTOKEN PTE. LTD.

4. Complete All Critical Initialization Steps Yourself

You must personally activate the device and create the wallet on the device. Be sure to watch the complete official unboxing video before setup.

Write down your recovery phrase offline and store it securely. Official customer support will never ask for your recovery phrase, private key, or PIN for any reason.

5. Follow the Emergency Loss-Prevention Procedure if Anything Appears Abnormal

If you have used a suspicious device or fake app, take the following actions immediately:

Stop using it: Do not deposit any additional assets into the affected wallet.

Transfer your assets: If there is any possibility that your recovery phrase has been exposed, do not take the risk. Immediately create a completely new wallet in a secure and genuine environment—using the official app or a genuine hardware wallet—and transfer all assets to the new secure address.

Preserve evidence: Keep the store order details, shipping label, photographs of the device, and customer service chat records.

Report the incident: Email support@imkey.im to report the incident and request assistance from the official imKey team.

The imKey team will continue investigating scams involving counterfeit hardware wallets and fake apps. Further confirmed information will be published through official channels.

imKey Team
July 30, 2026