Phishing protection for Arqma Wallet users

The threat in one line

Attackers don’t break Arqma Wallet’s cryptography. They convince you to hand them your seed phrase, your password, or your wallet file. Every loss you read about is a variation of that.

The playbook attackers use

• Fake download sites: a typo-domain that looks like the real Arqma Wallet site, ships a trojanised installer.
• Fake support staff: someone in chat DMs you saying they’re “Arqma support” and asks for your seed to “recover” your wallet.
• Fake wallet apps: phone apps with similar names on third-party app stores.
• Browser-based “wallet checkers”: sites that ask you to paste your seed to “verify ownership.”
• Sponsored search results: the top result for “arqma wallet download” could be an ad pointing at a malicious mirror.
• Compromised social posts: a hijacked X account “announcing” an emergency migration.

How to verify you’re on the real site

• Type the URL by hand or use a bookmark. Don’t click ads.
• Check the certificate is valid (the lock icon — click it for details).
• The download page links to checksum files. Always verify the SHA-256 of the file you downloaded before installing.

Red flags in chat / DMs

• Urgency: “you must migrate now or lose your funds.”
• Authority claim: “I’m from the Arqma team / admin / moderator.”
• Asking for the seed, password, or wallet file in any form.
• Pointing you at a non-arqma URL to “check” or “sync” or “validate.”
• Pressure to install something via a direct link.

Phishing-resistant habits

• Bookmark our download and community pages. Always navigate via the bookmark.
• Treat your seed phrase like a nuclear launch code: it never gets typed into anything except your own copy of Arqma Wallet, when restoring.
• For larger holdings, keep an offline savings wallet. The seed for that wallet never touches an online device after creation.
• Update Arqma Wallet to the latest official release periodically. Outdated software is easier to social-engineer around.

If you think you’ve been phished

1. If you typed your seed anywhere suspicious, assume the wallet is compromised. Create a brand-new wallet on a clean device, and move any remaining funds to the new address immediately.
2. If you only downloaded a suspicious installer but didn’t enter the seed: uninstall, scan the machine, reinstall Arqma Wallet from the official download page only.
3. Report what happened in the community channels so others can be warned.