Larp wallet on GitHub: what is there, and the risks of running it
Searching GitHub for a larp wallet returns dozens of repositories: fake Ledger, Phantom, Exodus and Coinbase screens, extensions and userscripts. What we saw on 31 October 2026, why cloning and running an unknown repository next to real wallets is the real risk (with a documented campaign of fake repositories that steal crypto), how to check a repo before you touch it, and the ready-made web app alternative.
Published:
On 31 October 2026 a GitHub search for larp wallet returned 61 repositories, mostly small hobby clones of wallet screens. We ran none. The risk is the unknown code: Kaspersky documented hundreds of fake repositories carrying crypto stealers. Vet a repo, use a separate browser profile, never type a seed phrase. A screen is never proof.
What a GitHub search for "larp wallet" returns
GitHub has plenty of hobby versions of a larp wallet. We searched on 31 October 2026 and read what came back. We did not download, install or run anything, and we make no claim about what any of these repositories contain beyond what their own listings say.
A larp wallet, also called a crypto wallet app simulator, is an app that shows a believable crypto wallet screen built from the balances you type in, for videos, skits, pitch decks and demos. It holds no funds and touches no blockchain.
| Search | What GitHub showed on 31 October 2026 |
|---|---|
| Repository search "larp wallet" | 61 repositories. On the first page: a role-play clone of Ledger Live (30 stars), a Phantom look-alike, a fake Ledger Live-style app, an Exodus-style page viewable on its GitHub page, a Chrome extension modeled on Phantom, a multi-skin wallet simulator built as a web app, and a userscript for the Coinbase wallet site. Most have 2 to 4 stars |
| Topic "transaction-simulation" | 38 repositories. Most are real security tools that preview a transaction before you sign it. The others are wallet-screen tools, among them a repository with 144 stars described as a wallet UI simulation tool, and six repositories with the same name and the same description, posted from different accounts, with one to four stars each |
Two things stand out. Almost all of them imitate a real brand's interface, which a maker can run into trademark trouble over. And the same repository copied under several accounts is a pattern worth noticing: copies are cheap, and a star count tells you little.
Open source: what it does and does not tell you
Open source means you can read the code. It does not mean anyone has. For a screen that only displays numbers, reading is feasible: a static page of HTML and CSS has little to hide. A browser extension or a userscript is different, because it runs inside your browser next to your real sites. An extension asks for permissions, and a userscript for a wallet site can read and change what that page shows. The risk grows with how much the code can touch, and with what else is in the same browser profile.
The real risks of running an unknown repo next to real wallets
The danger is not the idea of a fake wallet screen. It is running code you did not write on a machine that holds real wallets and logins.
- Fake repositories are a documented delivery route. In February 2025, Kaspersky described a campaign it called GitVenom: hundreds of GitHub repositories posing as legitimate software, such as a Telegram bot for managing bitcoin wallets and a tool for automating Instagram. They carried info-stealers that take saved credentials, wallet data and browsing history, remote access trojans and clipboard hijackers. The repositories were padded with inflated commit counts and polished instruction files to look active. At least one victim lost 5 BTC to a hacker-controlled wallet in November 2024.
- Clipboard hijackers. They watch for a copied wallet address and replace it with the attacker's. You paste, you send, and the funds go to the wrong place.
- Install scripts. A package that runs a command when you install it can fetch anything. Read the scripts section before you install.
- Download links in a README. A project that tells you to get a build from another site, instead of building from the code, is the red flag.
- Seed phrase prompts. A larp wallet never needs your recovery phrase, because it holds no funds. A screen or script that asks for one is the trap.
How to vet a repository, step by step
- Read the code, not the README. A README is marketing. Open the files that actually run.
- Look at the account. How old is it, what else has it published, and is the same project posted under other names?
- Check the history. A believable project has commits that change real things over time. Thousands of tiny commits or a file touched every few minutes is a warning.
- Prefer a plain static page. If a repository can be opened as a web page with no build step and no dependencies, you can read all of it in minutes. Some of the Exodus-style projects we saw were viewable on their GitHub page directly.
- Check the dependencies and the scripts. Anything with a long dependency list or an install script deserves a closer look.
- Isolate it. Use a separate browser profile or a virtual machine, with no wallet extension, no saved passwords and no real accounts in it.
- Never enter a key, and keep real funds elsewhere. If anything asks for a seed phrase, close it.
The alternative: an app that is already built
If what you want is a wallet screen for a clip and not a project, there is nothing to clone, build or vet. My Larp Wallet is a hosted web app: you open it in your browser, add it to your home screen, type your tokens and amounts, and it draws the screen full screen with live prices on five built-in tokens. It is a paid product, monthly or once for life, with a demo you can open first, and it never asks for a key or a recovery phrase. We do not offer a repository to run, so you judge it on what it asks of you: no download, no key, no extension. The homepage shows it moving, and the larp wallet apps compared page lists the other options. We are not affiliated with Phantom or any wallet maker. If you are after a Phantom-style look, see larp Phantom wallet.
A prop, never proof
A wallet screen from GitHub or from an app is a prop for a video, a skit or a demo. It is never proof of a balance or a payment, and showing it to someone to obtain money or trust is a false statement, whichever tool drew it.
Sources
- GitHub, repository search for larp wallet, read 31 October 2026
- GitHub, topic transaction-simulation, read 31 October 2026
- Kaspersky Securelist, Fake GitHub projects distribute stealers in GitVenom campaign, February 2025, also reported by Cointelegraph on 26 February 2025
- GitHub Docs, GitHub security features, read 31 October 2026
Questions
Is there an open source larp wallet on GitHub?
Yes, many small ones. On 31 October 2026 a GitHub search for larp wallet returned 61 repositories, among them role-play clones of Ledger Live, a Phantom look-alike, an Exodus-style page, a multi-skin web app and a Chrome extension. Quality and licenses vary, and we did not check the licenses. Stars are low: the most-starred result we saw had 30.
Is it safe to clone and run a larp wallet repo?
It is as safe as the code you run, and you cannot know that until you read it. A repository can look polished and still hide a script that downloads a stealer. Kaspersky documented that pattern in 2025. Reading the code, running it in a throwaway browser profile with no wallet extension, and never entering a key are what make it reasonable.
Can a fake wallet repo steal my crypto?
A repo that is only a static page cannot reach your wallet, but anything you install or run can. Kaspersky reported fake GitHub projects that carried info-stealers taking saved credentials and wallet data, and clipboard hijackers that swap a copied wallet address for the attacker's. One victim lost 5 BTC to such a project, per Cointelegraph's report of Kaspersky's findings.
How do I check a GitHub repository before running it?
Read the code instead of the README, check how old the account is and what else it has published, look at the commit history for a believable pace, read any install scripts, and refuse a README that sends you to download a file from another site. Run it in a throwaway profile or virtual machine with no real wallet in it.
Do I need to clone anything to get a larp wallet screen?
No. A larp wallet app that runs in the browser gives you a wallet screen with nothing to clone, build or install. My Larp Wallet is one: a hosted web app you add to your home screen, paid monthly or once for life, with no recovery phrase and no download. It is a hosted product, not a repository.
Is a larp wallet from GitHub proof of money?
No. A fake wallet screen from any source, open source or not, is a prop for a video, a skit or a demo. Shown to someone as your real balance to get money or trust, it is a false statement, whichever tool drew it.
Compose the screen instead of describing it
Your tokens, your amounts, your accent, laid out in the browser, then opened on your phone at your own address. A mockup, and we never pretend otherwise.
- Unlimited tokens, amounts and accents
- Add it to your home screen; it opens like an app
- Live market prices that keep moving
- Your own address, mylarpwallet.com/you
Cancel anytime · Secure payment by Stripe · Try the live demo
Keep reading
- Guide: Larp wallet and crypto larping, explainedThe three meanings the sources confuse, where the line between a mockup and a deception falls, and what the product makes.
- Larp wallet app: is there an APK, an IPA or a store version?My Larp Wallet has none of the three. The wallet is a web app that opens at your own address and sits on your home screen…
- Larp wallet APK for Android: there is none, Chrome installs itMy Larp Wallet has no APK and no Play Store listing: Chrome installs it from its own address in two taps. Google's current…
- Larp apps for iPhone and Android: what exists, what to avoid, and why there is no APK or IPAA larp app can be a store app, a web app on your home screen, or a file from a website, and the three ask very different…