| What to know |
|---|
| 1SparkKitty malware scanned phone photos for wallet recovery phrases. |
| 2The campaign appeared in Apple's App Store, Google Play and third-party stores. |
| 3Kaspersky says SOEX had more than 10,000 Google Play downloads before removal. |
| 4The fresh risk is seed phrase storage, not a new coin price catalyst. |
Market context as of 04:04 CEST. Bitcoin traded at $63,168.19 on Binance, 3.09% lower over 24 hours and close to the $63,059.39 low. BTCUSDT spot turnover was $1.03 billion, while Binance futures open interest stood at 105,955.649 BTC, or about $6.69 billion. The last funding rate was 0.000474%, so leverage was present but not paying an aggressive long premium.
SparkKitty malware makes gallery permission costly
Most wallet theft stories begin with a fake website or a signed transaction. This one starts with the phone gallery. Decrypt wrote that SparkKitty searched stored images after users gave photo access to infected apps.
Kaspersky’s writeup gives the sharper operational detail. On iOS, the malware sat inside a crypto-rate app called “币coin”. On Android, Kaspersky found it in SOEX, described as a messaging app with crypto-exchange features.
That matters because many holders still keep a recovery phrase as a screenshot. A seed phrase, the backup words for a wallet, can restore control of assets. If malware reads the image, the user may lose the wallet without signing anything.
App store presence changes the risk
The story is stronger than a normal sideloading warning. Kaspersky says SparkKitty reached both official app stores and less controlled distribution routes. It also found fake TikTok mods, gambling apps and third-party Android packages.
Apple and Google store placement does not prove every download caused a theft. It does show why permission prompts deserve more attention. A photo permission request from a crypto app can expose more than pictures.
Kaspersky says the campaign mainly targeted users in Southeast Asia and China. The same mechanics still travel well. U.S. traders use global apps, Telegram links, APK mirrors and exchange tools across borders.
Wallet risk meets leveraged Bitcoin
The CryptoFocus calculation is only a sensitivity check, not a reported SparkKitty loss. If 10,000 installs exposed 0.01 BTC each, theoretical wallet exposure would reach $6.32 million at the live Binance price. If each exposed wallet held 1 BTC, that rises to $631.7 million.
That larger scenario equals 61.6% of Binance BTCUSDT 24-hour spot turnover. It also equals 9.4% of Binance BTC futures open interest. The comparison shows why seed phrase hygiene is not a small retail footnote when crypto liquidity is thin.
| CryptoFocus calculation |
|---|
| 110,000 installs x 0.01 BTC equals $6.32 million at $63,168.19 per BTC. |
| 210,000 installs x 1 BTC equals $631.7 million in theoretical exposure. |
| 3That upper case equals 61.6% of Binance BTCUSDT spot turnover. |
| 4It also equals 9.4% of Binance BTC futures open interest. |
The broader tape was already soft. Binance spot data showed BTC near its daily low. CoinGecko global data put total crypto market cap near $2.25 trillion and daily volume near $69.29 billion.
What holders should check now
The practical check is simple. Seed phrases should not live in camera rolls, cloud photo backups or chat apps. That advice also applies to exchange recovery codes and screenshots of QR codes.
Users who installed unfamiliar wallet, exchange, messaging or entertainment apps should review photo permissions now. They should remove apps they cannot verify. A hardware wallet does less if the backup words sit inside an indexed photo library.
CryptoFocus has covered nearby risks before, including Steam malware that targeted wallets and the recent WEMIX bridge-security story. SparkKitty is different because it attacks an ordinary habit. The next useful datapoint is whether Apple, Google or security firms name more apps linked to the same code.
Disclaimer: This article is for information only and is not financial advice. Crypto assets are risky. Do your own research.
