Fake Ledger app drains $9.5M in crypto

TLDR

A fake Ledger Live wallet app on Apples App Store reportedly stole about $9.5 million in crypto from more than 50 users by tricking them into entering their recovery phrases.

1. The malicious app closely copied Ledger Live and captured users 12 or 24 word seed phrases, letting attackers drain funds across multiple blockchains.
2. Onchain analysis links the stolen funds to more than 150 KuCoin deposit addresses and a centralized mixer service called AudiA6, raising compliance questions for both Apple and KuCoin.
3. The key defense is never entering a seed phrase into any app or website and downloading wallet software only from official sources, regardless of app store vetting.

Deep Dive

1. How The Fake App Stole $9.5M

Reports attribute the incident to a counterfeit Ledger Live app that passed Apples review and appeared in the App Store between 7 and 13 April, during which more than 50 victims lost about $9.5 million in total value across BTC, ETH, SOL, TRX, XRP and stablecoins like USDT and USDC. Investigators say the app imitated the genuine interface and prompted users to restore their wallet by typing their 12 or 24 word recovery phrase, which is all an attacker needs to rebuild the wallet elsewhere and move funds. Several individual losses exceeded seven figures, including one theft of roughly $3.23 million in USDT and another of about $2.08 million in USDC, according to onchain researcher ZachXBT and subsequent coverage by outlets such as CoinDesk and Cointelegraph.

2. Laundering Path And KuCoin Scrutiny

Onchain tracing shows the stolen assets being funneled through more than 150 deposit addresses at KuCoin and then into AudiA6, a centralized mixing service that charges high fees to obscure transaction trails, as detailed in multiple investigations and reports. This has renewed criticism of KuCoins anti money laundering controls, particularly given its past regulatory issues and fines, and has prompted commentators to ask whether exchanges should detect and block such clustered high risk flows more effectively. At the same time, analysts suggest Apple could face legal exposure for allowing the fake app to pass review, with class action talk appearing in several reports.

3. How To Protect Yourself Next Time

A hardware wallet like Ledger is only as safe as how you handle the recovery phrase. Ledgers CTO has reiterated that Ledger will never ask for your 24 words inside a general purpose app or website. Practical safeguards include: 1) only downloading Ledger Live from the official ledger.com site, not by searching an app store; 2) never typing your seed phrase into a phone, browser, or desktop app unless you are explicitly restoring a wallet in software you obtained from the official site and you fully understand the risk; and 3) checking any incident alerts from Ledger and major security researchers before installing new wallet software.

Conclusion

This incident shows that trust in big app stores is not enough for crypto security. The combination of convincing fake branding, seed phrase capture, and rapid laundering through centralized exchanges turned a few clicks into multi million dollar losses. Going forward, the real protection comes from strict seed phrase hygiene and independent verification of wallet software, while regulators and exchanges decide how aggressively to police laundering routes exposed by investigations like this.