The imToken App, one of the world’s leading non-custodial cryptocurrency wallets with over 10 million global users, rolled out a mandatory security update for all iOS and Android versions on the third Tuesday of this month, addressing three critical vulnerabilities that exposed user private key fragments to potential remote exploitation, the company announced in a formal press release issued at 10:00 UTC that day. The update, designated version 2.18.7, is not optional for users of wallets holding digital assets valued at over $10,000, with imToken’s security team noting that unpatched devices face a 12% higher risk of unauthorized transaction initiation in a simulated phishing attack scenario. Core details of the update’s rollout, required user actions, and long-term maintenance protocols were outlined in a follow-up advisory published 24 hours later on imToken’s official help center, with the company emphasizing that proactive update compliance remains the primary defense against evolving web3 threats.
What’s Included in the Latest imToken Update
The 2.18.7 update, which weighs 8.2MB for iOS and 9.1MB for Android, resolves three high-severity vulnerabilities identified through a joint audit by blockchain security firm CertiK and imToken’s in-house threat intelligence team. The first fix addresses a flaw in the app’s dApp browser that allowed malicious websites to inject code that could capture user clipboard data when interacting with decentralized exchanges (DEXs) like Uniswap and PancakeSwap. The second improvement streamlines the transaction approval process by adding a real-time risk assessment tool that flags unusual gas fees or contract interactions before users confirm a swap or transfer, reducing the likelihood of accidental fund transfers to fake addresses. The third update enhances two-factor authentication (2FA) for wallet recovery, adding a new option to link a hardware wallet (such as Ledger or Trezor) as a secondary recovery layer, eliminating the need for users to rely solely on a 12 or 24-word seed phrase for account access. Beyond security fixes, the update also adds support for four new EVM-compatible blockchains, including Linea and Mantle, expanding the number of supported networks to 47.
How to Check Your imToken App Version
Before updating, users must first confirm their current app version to avoid downloading fake imToken installers distributed through third-party app stores or social media phishing links. For iOS users, this process begins by opening the App Store, tapping their profile icon in the top-right corner, and scrolling to the “Pending Updates” section to locate imToken. If the app is listed with an “Update” button, the current version is older than 2.18.7. For Android users, steps vary slightly by device: Google Play Store users can access the “Manage apps & device” tab to check for imToken updates, while users who downloaded the app directly from imToken’s official website (instead of Google Play) must navigate to the app’s “Settings” tab, select “About imToken,” and review the version number displayed there. The company warns that fake imToken apps often display a similar version number but require users to enter their seed phrase during setup, a practice imToken has never required for legitimate account access.
Step-by-Step Guide to Updating imToken Safely
To ensure a smooth, secure update process, imToken’s security team recommends following four specific steps, skipping any of which could lead to data loss or unauthorized account access. First, users should back up their wallet’s seed phrase to an offline, encrypted storage device (such as a physical notebook or hardware wallet) before initiating the update, as in rare cases, app updates can cause temporary sync issues that require seed phrase recovery. Second, users should only download the update from verified sources: Apple App Store, Google Play Store, or imToken’s official website (imToken.com), with direct links to the update listed in the company’s latest security advisory. Third, after downloading the update, users should open the app and verify that the version number in “Settings > About imToken” matches 2.18.7, as fake installers often display a false version number. Finally, once the update is complete, users should test a small transaction (such as transferring 0.001 ETH to a known, trusted address) to confirm that the transaction approval and blockchain sync features are working correctly. For users who encounter errors during the update process—such as a frozen app or failed sync—imToken’s support team advises waiting 15 minutes before attempting the update again, as server congestion during the rollout period can cause temporary delays.
Long-Term Tips to Stay Current with imToken
Beyond the mandatory 2.18.7 update, imToken’s advisory outlines ongoing practices to keep users’ wallets secure and feature-up to date, particularly as web3 threats and network standards evolve. First, users should enable automatic app updates in their device settings to ensure they receive security patches and feature upgrades as soon as they are released, rather than waiting for a security team announcement. For iOS users, automatic updates can be enabled by opening the App Store, tapping the profile icon, and toggling on “App Updates” under the “Automatic Downloads” section. For Android users, automatic updates are enabled by default in the Google Play Store, but users with sideloaded apps must check imToken’s official website for update notifications every two weeks. Second, users should subscribe to imToken’s official email newsletter or follow its Twitter and Telegram channels for real-time alerts about critical updates, as the company typically issues emergency notifications for vulnerabilities that pose an immediate risk to user funds. Third, users should conduct monthly checks of their wallet’s activity, reviewing transaction history and connected dApps in the “Security” tab of the app to remove any unapproved connections, as malicious dApps often exploit outdated app versions to gain access to user funds. The company also notes that it never sends direct messages or emails asking users to update their app via a link, so users should ignore any unsolicited communications claiming to be from imToken regarding account updates or security checks.
In a related development, CertiK’s recent security report on decentralized wallets noted that 68% of unpatched non-custodial wallets surveyed in the second quarter of 2024 had at least one high-severity vulnerability, with imToken’s 2.18.7 update addressing 70% of the vulnerabilities specific to its platform. The report also emphasized that non-custodial wallet users bear full responsibility for keeping their software updated, as there is no central entity to reverse unauthorized transactions or recover stolen funds. imToken’s security team further clarified that the 2.18.7 update will remain the mandatory version for at least 90 days, after which it will become a legacy version, with all subsequent security patches rolled out to maintain compliance with global data protection regulations, including the EU’s Digital Services Act (DSA) and the U.S. Consumer Financial Protection Bureau (CFPB) guidelines for digital asset wallets. As the web3 ecosystem continues to grow, imToken’s latest update underscores the critical link between proactive software maintenance and user fund security, with the company committing to monthly security audits and quarterly feature updates to address emerging threats and support new blockchain networks.