TLDR
A fake Ledger Live wallet app on Apples App Store stole at least $9.5 million in crypto from more than 50 users in about a week.
- A malicious Ledger Live clone on Apples App Store tricked victims into entering seed phrases, enabling thieves to drain wallets across several blockchains.
- On-chain analysis links at least $9.5 million in losses to over 150 KuCoin deposit addresses and a laundering service known as AudiA6.
- The incident highlights that hardware wallets stay safe only if the recovery phrase stays offline, and that app stores and emails cannot be trusted as proof of legitimacy.
Deep Dive
1. How The Fake App Stole $9.5M
Reports from multiple outlets describe a fake Ledger Live app that passed Apples App Store review and appeared when users searched for Ledgers official wallet manager. The clone closely copied Ledger branding and interface, so many users treated it as genuine.
Between 7 and 13 April 2026, victims were prompted to restore or verify their wallets by typing their 12 or 24 word recovery phrases. Once entered, attackers recreated those wallets on their own devices and drained funds across Bitcoin, Ethereum, Solana, Tron, XRP and stablecoins, with total losses of at least $9.5 million according to analyses from ZachXBT that are summarized by outlets like CoinDesk and Crypto.news.
Victims include users who lost full retirement-size balances after years of saving, which is why this incident is getting so much attention.
The failure point was not the Ledger hardware, it was users giving their seed phrase to a fake application that looked official.
2. Laundering Path And Platform Risk
On-chain tracing by ZachXBT, echoed in coverage from Bitcoin.com, shows the stolen funds moving through more than 150 deposit addresses at KuCoin and into a centralized mixing service dubbed AudiA6.
This use of a regulated exchange and a professional laundering hub shows how polished these crews are. It also pulls Apple and KuCoin into the conversation, since users reasonably assumed an app from the App Store had passed security review. Commentators are already talking about possible legal exposure for Apple over hosting the fraudulent listing.
Recovery is difficult once funds hit mixers and exchanges, and platform trust (Apple, KuCoin) is not a substitute for your own verification.
3. How To Protect Yourself Going Forward
Several key lessons emerge from this and earlier fake Ledger Live incidents on other app stores:
- Seed phrase rule: No legitimate wallet provider, including Ledger, will ever ask you to type your full recovery phrase into a connected app during normal use. If something does, stop immediately.
- Download sources: For high value wallets, get software only from the vendors official site (for Ledger, ledger.com), not by searching an app store or a search engine.
- Communication hygiene: Treat emails, letters or messages referencing Ledger updates, security incidents or KYC checks as suspicious, especially if they include links or QR codes and mention seed phrases.
If your recovery phrase has ever been typed into a website or non official app, you should treat that wallet as compromised and migrate funds to a new, securely created wallet.
Conclusion
The fake Ledger app attack shows how convincing brand impersonation plus a trusted distribution channel can defeat even hardware wallet users once the recovery phrase is exposed. For crypto holders, the practical takeaway is simple but strict: your seed phrase is the single point of failure, so never type it into any app, website or form, regardless of how official the request appears.
CoinsKid.Com