WalletConnect session hijacking and fake connection requests
WalletConnect is the bridge between your mobile wallet and a dApp. It replaces the old approach of pasting a wallet address into a website. A QR code appears. You scan it with your phone. Behind that simple scan is a session - a cryptographic link that both sides trust until one of them revokes it.
That session is the attack surface.
The session lifecycle in plain terms
When you scan a WalletConnect QR code, your wallet generates a long-lived session key. The dApp stores a copy. From that point, every signing request - approve a token spend, swap, mint an NFT - is a message signed with your key and sent through a relay server. The relay does not see the content. It just passes the encrypted payload.
This architecture is sound in theory. In practice, three points of failure exist: the QR code you scan, the relay server you trust, and the dApp interface you think you are using.
Where hijacking happens
Fake QR codes are the oldest trick. An attacker generates a WalletConnect URI and displays it as a QR code on a cloned site, a fake ad, or a social-media post. You scan it. Your wallet now thinks it is connecting to a real dApp. It is connecting to an attacker-controlled endpoint. Every subsequent request you sign goes to the attacker. They can drain tokens one permit at a time, and nothing looks wrong because the wallet UI shows a "connected" state.
Malicious relay servers are rarer but more insidious. WalletConnect is open-source and supports self-hosted relays. A compromised relay can replace your wallet's session key with a different one during the initial handshake. Your wallet says "connection valid." The dApp side says "connection valid." But both are talking through an invisible proxy that logs every message and can inject its own signing requests.
dApp front-end cloning is the most common today. The attacker copies the real site's interface exactly. They host it on a typosquatted domain or push it via a Google ad. You scan the QR code they show you. The session is valid, but the site you are looking at is not the one you intended. Every transaction you approve on that fake front-end is an approval to the attacker's contract.
How to audit active sessions
Open your mobile wallet's settings. Look for a "sessions" or "connections" list. Every wallet handles this differently, but the concept is universal. You should see each dApp you have connected to, the chain it uses, and the permissions you granted.
If you see a session you do not recognize, revoke it immediately. Do not check the dApp name alone. Check the domain. A session that says "OpenSea" but behind it shows "opensae.xyz" is a hijack.
Revoking the session is a one-tap operation. It kills the attacker's key. They cannot sign another request until you scan a new QR code. Do this habitually. Every week. Every time you finish a batch of transactions.
The "session invalid" warning
When a wallet displays "session invalid" or "session expired," most users treat it as a minor annoyance. Tap reconnect, scan again, move on.
That warning can be a signal of active interference. If your session drops while you are still using the dApp, something between your wallet and the relay server changed. It might be a relay swap. It might be the attacker's system failing. It might be a clean disconnect.
If the warning appears unprompted - you did not close the dApp, you did not revoke the session - do not reconnect immediately. Close the wallet. Verify the dApp URL again. Then manually revoke the old session before scanning a fresh QR code.
The hard truth about trust
WalletConnect outsources trust to the relay server and to the QR code generator. No single entity controls that chain. You are responsible for verifying the QR code came from the real dApp. You are responsible for checking that the relay server is the official one. You are responsible for auditing your sessions.
This page exists because none of that is intuitive. The steps are simple. The cost of skipping them is losing everything in the wallet.
Not financial advice. rabbitechnology.xyz publishes market data and general information about digital assets. Crypto assets are volatile and you can lose everything you put in. Nothing here is a recommendation to buy, sell or hold, and we make no price predictions.
Prices are sourced from third parties and may be delayed or wrong. Verify anything you intend to act on against a primary source.