Tampering in transit
A man-in-the-middle can rewrite the APK as it travels. SHA-256 mismatch is the first signal that the file is no longer what the operator signed.
Direct APK download for users outside the Play Store rollout. The page lists the current version, the SHA-256 hash, and the exact install steps. Verify the hash before you install.
| Field | Value |
|---|---|
| Version | Verify the current value in the app under Settings → About |
| SHA-256 | Verify the current hash on this page before installing |
| Package | in.weccap.fantasy |
| Size | 55–70 MB |
| Min Android | 8.0 (Oreo) |
| Architecture | ARM64 |
The desk does not publish version numbers or hashes here to avoid stale values driving install of an older build. Open the app once installed, then verify the version under Settings → About.
Tap the download button. Save to the Downloads folder.
Open Terminal, run shasum -a 256 wecap-latest.apk. Compare to the published hash on this page.
Settings → Apps → Special access → Install unknown apps. Allow for your browser only. Disable after install.
Tap the APK. Confirm package name reads in.weccap.fantasy. Open the app.
Return to Settings and revoke the install permission. Future updates arrive over the air.
A man-in-the-middle can rewrite the APK as it travels. SHA-256 mismatch is the first signal that the file is no longer what the operator signed.
Mirror sites may copy the icon and the page chrome but cannot copy the signing certificate. The hash differs from the operator's build.
Some ad-injecting networks rewrite downloads on the fly. The SHA-256 check catches the rewrite and prompts a clean re-download.
Yes, when downloaded from this domain and when the SHA-256 matches the published value. The APK is signed by the operator with the same key as the Play Store build.
The app refuses to start on rooted devices because payment KYC requires the trusted execution environment. Use a stock device.
Functionally identical. The Play Store build ships with auto-update and Play Protect scans. The APK is the same code signed by the same key.
Yes. The APK is tested on Android Go devices with 1 GB RAM. Signal refresh intervals are slightly longer on low-RAM devices.
Android 8.0 (Oreo) or above is required. Older devices cannot run the current APK. Update the OS, or contact customer care for assistance.
No. The Wecap app does not show third-party advertising. Background data use is for live signals only.
Wecap publishes what the desk has read and verified. Deposit limits, contest structures, and welcome terms are governed by the operator — confirm inside the app before you commit.