A fraudulent Ledger app pillaged $9.5M from App Store users in six days
A malicious clone of Ledger Live, the wallet management software produced by hardware wallet maker Ledger, was listed on Apple's App Store and used to steal roughly $9.5 million in cryptocurrency from at least 50 victims between April 7 and April 13, according to blockchain investigator ZachXBT.
The theft spanned multiple blockchains, including Bitcoin, Ethereum, Tron, Solana, Ripple, and several EVM-compatible networks. Apple removed the application after ZachXBT flagged the incidents in a Telegram post on Tuesday.
Scale and composition of losses
Three victims each suffered losses exceeding $1 million. The largest individual loss was $3.23 million in USDT; the second-largest was $2.079 million in USDC; the third involved a combined $1.95 million in assets comprising 20.64 BTC, 211 stETH, and 70 ETH. The attack follows a similar incident on April 12, in which American musician Garrett Dutton, known as G. Love, reported the loss of 5.9 BTC after entering his seed phrase into a comparable fraudulent application.
Laundering infrastructure
ZachXBT traced the stolen funds through more than 150 deposit addresses on KuCoin tied to AudiA6, which he described as a centralised mixing service that launders illicit proceeds for high fees. He also flagged a broader pattern of increasing illicit flows through KuCoin, noting a separate investigation in which he traced roughly 54 BTC, valued at approximately $3.7 million, stolen from Bitcoin Depot to KuCoin wallets.
KuCoin's regulatory standing is already under pressure. The Seychelles-based exchange paid more than $300 million in fines to the U.S. Government in January 2025 to settle Anti-Money Laundering charges. In February 2026, Austrian regulators barred the exchange from onboarding new European Union users, despite KuCoin having received its MiCA licence the previous November.
Platform liability and user guidance
ZachXBT questioned Apple's liability for hosting the fraudulent application. Ledger has previously warned that official app stores can carry malicious software impersonating its products. Ledger Chief Technology Officer Charles Guillemet stated: "Ledger will never ask for your 24 words. If anyone, or any app, is asking for your 24 words, assume something is wrong. The only protection that holds is keeping your private keys on a dedicated hardware device with a secure screen." The company directs customers to download its wallet software exclusively from its official website.
