Fake wallet app scam steals $9.5M

TLDR

A fake Ledger Live wallet app on Apples App Store stole about $9.5 million in crypto from over 50 users by phishing their seed phrases and laundering funds through KuCoin-linked addresses.

1. A malicious Ledger Live clone passed Apple review, tricking users into entering their recovery phrases and draining wallets across Bitcoin, Ethereum, Solana, Tron, XRP and others.
2. Investigators traced funds through more than 150 KuCoin deposit addresses tied to a centralized mixer called AudiA6, highlighting how phishing and laundering are driving a large share of crypto losses.
3. The key protections are simple but strict: never enter a seed phrase into any app or website, only download wallet software from the official site, and expect more legal and regulatory fallout around Apple and KuCoin.

Deep Dive

1. How The Scam Worked

Reports show a fake version of the Ledger Live desktop app was approved and listed in Apples App Store, closely mimicking the real interface so victims believed it was legitimate. Users were prompted to restore their wallet by entering the full 12 or 24 word recovery phrase, something the real Ledger Live does not ask for during normal setup.

Once victims entered their phrase, attackers could recreate those wallets elsewhere and sweep all assets. Coverage from multiple outlets attributes at least $9.5 million in losses across more than 50 victims, including large single hits of $3.23 million in USDT, $2.08 million in USDC, and about $1.95 million in BTC, ETH and stETH over April 7 to 13 on multiple chains including Bitcoin, EVM networks, Solana, Tron and XRP.

Ledgers CTO reiterated that Ledger will never ask for your 24 words and that any such request is a red flag in itself.

2. Why It Matters Now

Onchain investigator ZachXBT traced the stolen funds through more than 150 KuCoin deposit addresses linked to AudiA6, described as a centralized mixing service used to obfuscate illicit flows across exchanges, with several articles detailing this pattern.

Separate security research shows phishing and social engineering scams already accounted for about 63 percent of crypto losses in a recent quarter, vastly outweighing pure smart contract exploits, and highlighting that human trust is now the main attack surface.

This incident also questions how a sophisticated fake cleared Apples app review and whether Apple could face class action claims for hosting a fraudulent wallet app, while KuCoin faces renewed scrutiny over its anti money laundering controls.

3. Protection And Next Steps

For individual users, the critical rules are: never type a hardware wallet seed phrase into any app, browser page or phone, and only download wallet software from the vendors official website, not by searching an app store. A genuine hardware wallet flow typically involves confirming addresses on the device, not exporting the seed into software.

If someone has already entered a seed into a suspicious app, the safest pattern is to assume that wallet is fully compromised, move any remaining funds to a brand new wallet with a new seed, and treat the old one as burned. Recovery of fully drained funds is unlikely once they hit mixers and exchanges, though law enforcement may still act.

At the ecosystem level, pressure is likely to increase on platform operators like Apple and KuCoin to tighten listing review, monitoring and AML controls, and more of these cases could become tests for platform liability around crypto scams.

Conclusion

A convincing fake Ledger Live app turning Apples App Store trust into a $9.5 million phishing attack shows that user psychology, not code, is now the primary weak point in many crypto losses. Protecting seed phrases, verifying wallet downloads at the source, and treating any software that asks for your 12 or 24 words as hostile are the most effective defenses, while regulators and investigators focus on exchanges and platforms that enable laundering of stolen funds.