Fake wallet app on iOS steals $9.5M

TLDR

A fake "Ledger Live" wallet app on Apples App Store stole around $9.5 million in crypto from more than 50 victims in about a week.

1. The malicious Ledger Live clone passed Apple review, tricked users into entering their recovery phrases, and drained funds across Bitcoin, Ethereum, Solana, Tron and XRP.
2. On-chain investigator ZachXBT traced the stolen funds through over 150 KuCoin deposit addresses tied to a centralized mixer service, raising questions about exchange and app-store controls.
3. The core lesson is operational security: never type a seed phrase into an app or website, verify wallet software only via official links, and assume recovery is near impossible once funds are laundered.

Deep Dive

1. How The Attack Worked

Reports say a fraudulent version of Ledger Live was listed on Apples App Store between 7 and 13 April 2026 and was used to steal at least $9.5 million from more than 50 victims across multiple chains, including Bitcoin, Ethereum, Solana, Tron and XRP. One detailed account notes three single victims each lost seven-figure amounts in USDT, USDC, and a mix of BTC, ETH and stETH.

The fake app closely mimicked the real Ledger Live interface and presented itself as a legitimate companion for Ledger hardware wallets. After installation, it prompted users to "restore" their wallet by entering their 12 or 24 word recovery phrase, which gave attackers full control of all associated funds.

Importantly, this was not a protocol or hardware exploit. It was a classic phishing and social-engineering attack that weaponized a convincing app-store listing plus a fraudulent UI to capture seed phrases.

2. Laundering Route And Platform Risks

On-chain investigator ZachXBT linked the stolen funds to more than 150 deposit addresses on KuCoin and a centralized mixing service known as AudiA6 that charges high fees to obfuscate flows, according to several investigations and Cointelegraphs summary. Another breakdown estimates at least $3.23 million in USDT, $2.08 million in USDC, and $1.95 million in BTC, stETH and ETH among the largest cases.

Because the funds went into centralized venues and a mixer, tracing is possible but practical recovery is unlikely once they are swapped, blended, and withdrawn. The episode also adds to existing regulatory scrutiny of KuCoins anti-money-laundering controls and raises questions about how such a convincing fake passed Apples review process and stayed live for days.

3. Practical Security Takeaways

For Ledger specifically, the companys CTO has reiterated that Ledger will never ask for your 24-word recovery phrase inside an app or website; any request like this should be treated as an immediate red flag.

More generally, safer patterns include: navigating to wallet downloads from the vendors official website, checking the developer name carefully on any app store listing, and treating app-store presence as a convenience signal, not as security assurance.

Once a seed phrase is exposed and funds have moved into mixers or exchange accounts controlled by attackers, options shrink to forensic reporting and law-enforcement engagement. Users should plan as if such losses are irreversible and design their habits to avoid ever exposing the seed in the first place.

Confidence: high because multiple independent investigations and major media reports agree on the amounts, timelines, and attack method.

Conclusion

The fake Ledger Live app incident shows how a convincing clone in a trusted app store can bypass even experienced users defenses and lead to total loss of self-custodied funds. The technical crypto rails worked as designed, but social engineering plus weak app-store screening and lax laundering controls created a deadly combination. For everyday crypto users, the most effective protection is strict discipline around seed phrases and independent verification of any wallet software, rather than relying on platform trust alone.