Download the BitMEX app without installing somebody else's

Before you install anything

Decide first whether a derivatives client is the app you actually want. This matters more than any installation detail. If your plan is to buy Bitcoin monthly and hold it, a leveraged perpetuals venue adds risk, complexity and account restrictions with no upside for you. If your plan is to trade contracts actively, then yes — read on.

Second, understand what installing an exchange app means. You are not creating a wallet. You are creating an account at a company that will hold your coins for you. The app is a window into their ledger. That is the custodial model, and it is why the security work below focuses on your login rather than on a seed phrase. Our platform overview explains the distinction and when each model is appropriate.

How a cloned client actually reaches you

The distribution routes are boringly consistent, which is good news — a short checklist covers nearly all of them.

• Paid search results. A sponsored result above the real one, on a domain one character off. Type the address manually and this route disappears.
• In-store keyword squatting. Searching an exchange name inside an app store surfaces dozens of unrelated "trading assistant" apps. Reach listings via links from the operator's own site instead.
• Support impersonation. A helpful account in a Telegram or X thread sends you a "mirror download" because the official one is "under maintenance". It never is.
• Sideloaded APKs. Blog posts promising an unrestricted regional build. These are malware more often than not, and the ones that are not malware still break the terms you agreed to.

The five-step install

1. Start from the operator’s own domain, never from a search ad

   Type the official address into the address bar yourself and follow the store link published there. Fake trading apps buy search ads and app-store keywords; the URL bar is the one field an attacker cannot rewrite.

2. Check the developer name, not the app icon

   Icons and screenshots are trivially copied. Open the listing’s developer profile and confirm the publisher entity matches the company named in the platform’s own legal documentation, then look at the release history — a genuine exchange client has years of updates, not three.

3. Install, then refuse every optional permission

   A trading client needs network access and notifications. It does not need SMS, contacts, call logs, accessibility services or the ability to draw over other apps. Accessibility permission in particular is the standard tool for screen-reading malware.

4. Set up two-factor authentication before your first deposit

   Use an authenticator app or a hardware key. Save the recovery codes offline. Do not use SMS: a SIM swap turns your phone number into somebody else’s second factor.

5. Add a withdrawal address whitelist and test with a small amount

   Whitelist the wallet address you will actually withdraw to, then move a token amount out and back before committing real size. The test costs a network fee and buys certainty about the whole round trip.

Android and iOS are not the same risk

People treat the two stores as interchangeable. From a security standpoint they are not, and the difference changes what you should watch for.

Permissions worth refusing

Grant the minimum. A trading client works perfectly with network access and push notifications alone. Everything below is a request you should decline unless you can name the feature that needs it.

• Accessibility services — lets an app read and control your screen. Almost never legitimate for a trading client.
• SMS and call logs — historically requested to auto-fill codes; also everything a SIM-swap attacker wants.
• Contacts — used for referral harvesting, not for trading.
• Draw over other apps — the mechanism behind overlay phishing screens.
• Unrestricted background location — a compliance app may check region once; it does not need continuous tracking.

Finishing the setup properly

Installation is the easy half. The half that determines whether you keep your money is what you do in the next fifteen minutes.

Lock the login

A unique password from a password manager, app-based or hardware two-factor authentication, and recovery codes stored offline. Then enable the biometric lock inside the app so a stolen, unlocked phone still cannot place orders.

Lock the exit

Turn on the withdrawal address whitelist and add the wallet you control. With a whitelist active, an attacker who fully owns your session still cannot send funds anywhere new without tripping a delay and an email you will see.

Prove the round trip

Deposit a small amount, trade nothing, and withdraw it to your own wallet. You will learn the real confirmation times, the real fee, and whether anything in your account triggers a manual review — while the stakes are trivial. Nobody regrets doing this. Plenty of people regret skipping it.

Keeping it trustworthy after install day

A verified install is a snapshot, not a permanent state. Three habits keep it that way.

Update deliberately, not automatically-and-blindly

Automatic updates are correct for security patches, and you should leave them on. But when a release changes something material — a new permission request, a redesigned withdrawal flow, a fresh login prompt after updating — read the release notes before carrying on. A legitimate app does not gain a need for accessibility access in a point release. If one appears to, that is the moment to check the developer profile again rather than tapping through.

Keep the device boring

The app can only be as trustworthy as the phone it runs on. That means a current OS version, a screen lock that is not a four-digit PIN you also use elsewhere, no sideloaded APKs from anywhere, and no "battery optimiser" or "screen recorder" utilities with sweeping permissions. Trading from a rooted or jailbroken device removes the sandbox that does most of the work of keeping your session private.

Re-check the exit path every few months

Whitelists drift. People add an address for a one-off transfer and forget it. Wallets get replaced and the old address stays approved. Open the withdrawal settings occasionally and prune anything you would not want a stranger sending your balance to — because in the scenario that matters, a stranger is exactly who is choosing from that list.