Loading story…
A malicious macOS app impersonating Ledger Live was distributed through Apple’s App Store and linked to the theft of more than $9.5 million in cryptocurrency from over 50 victims. Investigators said the app used Ledger branding, fake credibility signals, and prompts for users’ seed or recovery phrases, allowing attackers to seize control of wallets and drain assets across multiple networks, including Bitcoin, Ethereum, Solana, Tron, and XRP. The fraudulent listing was reportedly published under Leva Heal Limited rather than Ledger and showed a suspicious version history that jumped rapidly from 1.0 to 5.0 within roughly two weeks.
Blockchain investigator ZachXBT traced the stolen funds from intermediary wallets into more than 150 KuCoin deposit addresses, after which they were laundered through a centralized mixing service known as AudiA6. Apple removed the app after user reports, and KuCoin said it froze the implicated accounts pending possible law enforcement action. The thefts, reported over a span of days in April, have intensified scrutiny of Apple’s app review process and underscored the continuing risk of fake wallet and financial apps appearing in trusted software marketplaces.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
A Brazilian cybersecurity researcher identified a supply-chain scam in which counterfeit Ledger Nano S Plus devices sold on Chinese marketplaces replaced the secure element with an ESP32-S3 and stored victims’ PINs and seed phrases in plaintext for exfiltration. The operation also directed users to a cloned Ledger site and fake app that falsely passed authenticity checks, extending the campaign beyond the previously reported App Store malware.
KuCoin said it froze the deposit accounts tied to the laundering activity and would keep them frozen until April 20 pending possible law enforcement action. This response targeted the addresses identified in the tracing of the stolen funds.
Apple removed the fraudulent Ledger Live app from the App Store after users reported it. The app had been published under the name Leva Heal Limited and used suspicious version-history changes to appear legitimate.
Blockchain investigator ZachXBT linked the stolen assets to intermediary wallets, more than 150 KuCoin deposit addresses, and the centralized mixing service AudiA6. The tracing showed the campaign was a broad credential-theft operation rather than a chain-specific exploit.
Between April 7 and April 13, a malicious macOS app impersonating Ledger Live on Apple’s App Store harvested seed or recovery phrases and stole more than $9.5 million in cryptocurrency from over 50 victims. The thefts affected wallets across multiple blockchains, including Bitcoin, Ethereum, Solana, Tron, and XRP.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcehackread.com
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourcet.me
Open sourcebitdefender.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified a **FakeWallet** campaign that placed at least **26 malicious iOS apps** in Apple’s App Store, where they impersonated well-known cryptocurrency wallets including **MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken, and Bitpie**. The apps primarily targeted users in **China**, taking advantage of the fact that many legitimate crypto wallet apps were unavailable in the local App Store, and used typosquatting, fake branding, and phishing flows to redirect victims to browser-based credential theft pages or trojanized wallet installers. Investigators said the operation had likely been active since at least late 2025, and Apple was notified and removed several of the identified apps. The malware used multiple techniques to steal wallet secrets from both hot-wallet and cold-wallet companion apps, including **malicious `dylib` injection**, executable hooking, provisioning profiles, and **React Native code tampering**. For hot wallets, the implants scraped mnemonic seed phrases and private keys directly from wallet interfaces; for Ledger-themed variants, the apps displayed convincing in-app prompts and fake verification pages to trick users into entering recovery phrases. Stolen data was **RSA PKCS #1-encrypted**, Base64-encoded, and sent to attacker-controlled servers, and researchers assessed the activity may be linked to the **SparkKitty** threat based on shared modules, Chinese-language artifacts, similar fake App Store-style distribution, and overlapping cryptocurrency theft objectives.
Jun 29, 2026
Apple is facing a California federal lawsuit after three customers said they lost a combined **$1.8 million in Bitcoin** by downloading a fake **Sparrow Wallet** app from the App Store. The complaint alleges the fraudulent iOS app impersonated the legitimate Sparrow Wallet product—even though the real wallet is not available on iOS—and tricked victims into entering their seed phrases, allowing attackers to transfer cryptocurrency to wallets they controlled. The lawsuit claims Apple misrepresented the App Store as a safe and trusted marketplace while failing to adequately review, monitor, and remove impersonation apps despite prior public warnings from Sparrow Wallet developer Craig Raw and reports from affected users. Apple said it has since removed the fake apps, terminated the associated developer accounts, and pointed to its existing anti-fraud enforcement measures and reporting channels for scams and intellectual property abuse.
Jul 31, 2026
Threat actors used **punycode and other lookalike domains** to impersonate Ledger and target cryptocurrency users after the company's customer data breach became public. Proofpoint reported thousands of phishing emails directing victims to a spoofed Ledger site that offered trojanized `Ledger Live` installers for **Windows, macOS, and Linux**. The altered application removed normal setup options, coerced users into entering wallet recovery phrases, validated the words against the **BIP-39** mnemonic list, and exfiltrated completed seed phrases over HTTP, enabling theft of associated cryptocurrency. A parallel campaign used fake Ledger web pages, likely distributed by SMS, to steal recovery phrases without requiring a download. Separate infrastructure analysis tied Ledger-themed domains to a broader **homograph-domain** operation that also impersonated **Brave, Signal, and Telegram** through internationalized domain names encoded with the `xn--` **Punycode** prefix. Silent Push identified domains such as `xn--brav-yva[.]com`, promoted through Google ads, that delivered ISO files linked to the **RedLine infostealer**, and said the registrations and hosting overlapped with other brand-impersonation activity. Together, the reporting shows attackers combining breach-themed social engineering, IDN spoofing, and malware delivery to compromise cryptocurrency holders and steal credentials or wallet access without attacking Ledger hardware directly.
Aug 15, 2026