Fake Ledger App on Apple Store Stole $9.5M Fast

A fake Ledger Live app listed on Apple’s App Store was tied to more than $9.5 million in crypto thefts from over 50 victims between April 7 and April 13, 2026, according to blockchain investigator ZachXBT and reports published on April 14, 2026. The case matters because it did not spread through a shady download portal. It spread through a trusted storefront. That’s the part competitors touched on, but did not fully unpack: the real failure here is distribution trust, not just phishing discipline.

Theft Total Crosses $9.5 Million in Just Seven Days

The number is ugly. More than $9.5 million gone in one week. The Block reported on April 14, 2026, at 10:05 a.m. EDT that a fraudulent Ledger Live application on Apple’s App Store was linked to roughly $9.5 million in losses across Bitcoin, Tron, Solana, Ripple and multiple EVM networks, citing ZachXBT’s investigation. Decrypt separately reported on April 14, 2026 that the fake Mac app drained more than $9.5 million from over 50 users during the April 7 to April 13 window. Cointelegraph matched the broad figures the same day, adding that Apple removed the app on April 13, 2026.

That cross-verification matters. When three outlets line up on the same core figures, and all attribute the findings to the same on-chain investigator, the baseline becomes harder to dismiss. The average loss implied by the public tally is about $190,000 per victim, based on $9.5 million divided by 50 victims. That average likely understates the skew, because the biggest wallets were hit far harder than the median user. In other words, this was not a spray-and-pray scam. It appears to have captured a mix of retail and high-value holders.

I’ve tracked enough wallet-drain stories to know when a pattern changes. This one did. The scam’s edge was not technical novelty. It was placement inside a platform many users treat as pre-vetted. That changes user behavior. People who would never type a seed phrase into a random website may still lower their guard when the download comes from an official store listing.

Why App Store Trust Triggered Faster Losses Than a Typical Phishing Page

Here’s the mechanism. A fake app impersonating Ledger Live gets distribution through Apple’s storefront. A user installs it on a Mac. The interface looks legitimate enough to prompt wallet restoration or setup. The victim enters a 24-word recovery phrase. Funds are then drained. Ledger’s chief technology officer Charles Guillemet told Cointelegraph that Ledger never asks users for their 24-word recovery phrase and warned that users cannot assume the surrounding software environment is safe, even when it looks official.

That warning is not abstract. Cointelegraph reported one victim lost about $420,000 in Bitcoin after downloading the malicious app from Apple’s App Store and entering a seed phrase. It also listed three seven-figure losses tied to the broader incident: about $1.95 million in Bitcoin, staked Ether and Ether; about $3.23 million in USDT on April 9, 2026; and about $2 million in USDC on April 11, 2026. Decrypt reported one wallet was drained of $3.27 million in USDT, while swiped assets included Bitcoin, Solana, XRP and USDT.

What competitors mostly missed is the speed profile. Seven days. More than 50 victims. That works out to at least 7.1 victims per day and roughly $1.36 million in losses per day using the reported minimums. For a wallet-drain campaign, that’s fast. It suggests the listing had enough visibility, credibility or ranking power to keep feeding new victims before removal.

150+ KuCoin Deposit Addresses While Victim Count Stayed Near 50 Shows Structured Laundering

The laundering trail is another underplayed angle. ZachXBT said the stolen funds moved through more than 150 KuCoin deposit addresses tied to AudiA6, described as a centralized mixing service. If that figure holds, the operation used at least three deposit addresses for every known victim. That does not prove sophistication on its own, but it does suggest deliberate fragmentation designed to complicate tracing and recovery.

There is precedent for fake Ledger apps appearing in official software marketplaces. CoinDesk reported in November 2023 that a fake Ledger Live app on Microsoft’s store led to at least $590,000 in Bitcoin theft, with ZachXBT later saying the total across chains rose to roughly $770,000. Compare that with the Apple-linked case: $9.5 million versus $770,000. That is about 12.3 times larger. Same brand impersonation theme. Much bigger blast radius.

Apple’s own public claims sharpen the contradiction. In a 2025 newsroom post, Apple said the App Store prevented more than $9 billion in fraudulent transactions and reviewed over 7.7 million submissions in 2024, rejecting more than 1.9 million for failing standards tied to security, reliability and fraud. In a 2024 post, Apple said it reviewed nearly 6.9 million submissions in 2023, or about 132,500 apps a week on average. Big numbers. Serious effort. Yet one fake wallet app still appears to have slipped through and stayed live long enough to facilitate a multimillion-dollar theft.

Can Apple and Wallet Users Rebuild Trust After a $9.5 Million Miss?

That’s the forward question. For Apple, the pressure point is review credibility. For Ledger users, it’s operational discipline. The hard rule has not changed: a recovery phrase belongs on the hardware wallet backup, not in an app prompt. Ever. But platform trust clearly altered behavior here, and that means the security lesson is broader than “users should know better.” Distribution channels shape risk. When a malicious app sits inside a trusted store, the store inherits part of the attack surface.

Data Verification: The $9.5 million total, 50+ victim count, April 7 to April 13 incident window, and 150+ KuCoin deposit addresses were all reported on April 14, 2026 by at least two of Decrypt, The Block and Cointelegraph, each citing ZachXBT. The largest known losses ranged from about $1.95 million to $3.27 million depending on asset mix and outlet-specific breakdowns. Those figures are consistent enough to establish the scale, even if final forensic totals may still move.