A fake Ledger Live app on the Apple App Store successfully drained approximately $9.5 million in crypto from 50+ users between April 7 and April 13, 2026, according to a report by CoinDesk.
The breach is particularly notable because it occurred within Apple’s walled garden, a marketplace often touted for its rigorous review process. Despite these safeguards, the fake app remained available long enough to trick both novice and experienced investors across multiple blockchain networks.
According to on-chain analysis shared by prominent security researcher ZachXBT, the attackers utilized a high-fidelity replica of the legitimate Ledger Live interface. The scam operated on a simple but devastating premise: the app prompted users to enter their 24-word “seed phrase” or “recovery phrase” under the guise of restoring a wallet or syncing a device.
The official Ledger hardware wallet and its companion software are specifically designed so that users never have to type these words into a computer or phone. However, by mimicking the branding and professional aesthetic of the real company, the scammers convinced users to hand over these keys directly.
Once the seed phrases were harvested, the attackers reconstructed the victims’ wallets on their own devices. They then systematically emptied the accounts across various chains, including Bitcoin (BTC), Ethereum (EVM), Tron (TRX), Solana (SOL), and the XRP Ledger (XRPL).
The single largest confirmed theft from the campaign was recorded on April 9, when one victim was drained of $3.22 million in Tether (USDT). Forensic mapping shows that the stolen funds were quickly laundered through various platforms
This incident has sparked renewed criticism of Apple’s App Store vetting procedures. While Apple recently reported preventing billions in fraudulent transactions, this specific Ledger clone managed to slip through the cracks, leading to life-altering financial losses for many.
The fraudulent app was eventually flagged and removed from the Mac App Store on Monday, April 13, but not before the damage was done.
Want to see more of our stories on Google?
P.S. Want to keep this site truly independent? Support us by buying us a beer, treating us to a coffee, or shopping through Amazon here. Links in this post are affiliate links, so we earn a tiny commission at no charge to you. Thanks for supporting independent Canadian media!
