Google LLC has removed three fake bitcoin wallets from its Play Store that had potentially stolen significant sums of cryptocurrency from its users.

Discovered by researchers at mobile security firm Lookout Inc., the three wallets, part of the “PickBitPocket” mobile malware family, were all pretending to be legitimate bitcoin wallets. But instead of operating as a regular service, they hijacked transactions.

An example provided involves a scenario where an individual is selling goods or services in return for bitcoin. The app user would usually add the seller’s bitcoin address to the app to make a payment. But in the case of the fake apps, that address is substituted by one controlled by those behind the fake apps, meaning that the payment is sent to the attacker instead.

Two of the apps, “Bitcoin Mining” and “Fast Bitcoin Wallet,” had “up to 5,000 installs,” while the last app, “Blockchain Bitcoin Wallet – Fingerprint,” had “up to 10,000 installs.”

“As bitcoin captures broader interest, this means more people may be purchasing the cryptocurrency, or looking for mobile wallets to store their coins,” the researchers noted.

Fake bitcoin wallets are not new and are not limited to Android alone. A number of fake wallet apps were found in Apple Inc.’s App Store back in August 2016. Bitcoin scams were also reported to be on the rise in March, when bitcoin was only trading at around the $1,000 mark. It hit record highs of around $18,000 a week ago, a rise that is likely attracting even more hackers and scammers to try their luck.

As always, users are advised to practice safe internet. “Individuals should be vigilant in choosing a secure wallet and should also have a security solution in place… to identify malicious activity on their device,” the Lookout researchers concluded.

Image: Lookout