A fake Ledger app on the Apple App Store drained $9.5 million in crypto

A malicious Ledger Live clone slipped onto Apple’s App Store, draining millions from dozens of victims across multiple blockchains in a week-long phishing campaign.

What to know:

• A fake Ledger Live app led to at least $9.5 million in losses across 50+ victims on Bitcoin, Ethereum, Solana, Tron and XRP between April 7–13.
• Stolen funds were traced to KuCoin deposit addresses and linked to a centralized laundering service known as AudiA6.
• Victims say they unknowingly entered recovery phrases into the malicious app, giving attackers full access to their wallets.

A fake version of Ledger Live distributed via Apple’s App Store has been linked to at least $9.5 million in crypto theft, with victims now coming forward describing devastating losses, including entire retirement funds wiped out “in an instant.”

One victim, posting on X under the handle @glove, said he lost 5.9 BTC – his entire savings accumulated over a decade – after downloading what he believed was the official Ledger app while setting up a new computer.

“I lost my retirement fund in a hack/scam… All my BTC gone in an instant,” he wrote.

Blockchain investigator ZachXBT later traced the stolen 5.92 BTC, showing it was rapidly funneled through a series of transactions into KuCoin deposit addresses, consistent with a broader laundering pattern identified across the incident.

Apple and KuCoin did not immediately respond to requests for comment.

$9.5 million stolen across chains

X user @glove wasn't the only victim. The phishing campaign, active between April 7 and April 13, impacted more than 50 suspected victims across Bitcoin, Ethereum-compatible networks, Tron, Solana and XRP.

Three of the largest victims lost seven-figure sums, with $3.23 million in USDT being stolen on April 9, $2.08 million of USDC on April 11 and $1.95 million in BTC, ETH and stETH being drained on April 8.

Cases like this typically prompt victims to enter their recovery phrase on an app, giving attackers full access to their wallets.

Laundering via KuCoin and ‘AudiA6’

Stolen funds were routed through more than 150 KuCoin deposit addresses and tied to “AudiA6,” a centralized crypto mixing service known for charging high fees to obfuscate illicit flows.

The reliance on a centralized exchange as a laundering hub is notable given KuCoin’s recent regulatory troubles. The exchange was barred from onboarding new EU users by Austrian regulators in February 2026, just months after receiving a MiCA license, and previously paid over $300 million to U.S. authorities to settle anti-money laundering violations in 2025.

App Store scrutiny

Apple removed the fake Ledger Live app from the App Store, but questions remain about how it passed review and how long it was available.

The scale of losses, coupled with the fact that the app was distributed through Apple’s official marketplace, could expose the company to legal risk, with ZachXBT suggesting the incident may form the basis for a class-action lawsuit.

Rising threat

The incident highlights a persistent threat that has marred the crypto industry over the past few years. In 2025 crypto investors lost around $17 billion to hacks and scams, with social engineering and phishing tactics leading the way in terms of attack vectors.

For victims, the damage is already done.

“I worked ten years for this,” the victim wrote. “Be careful out there.”

More For You

Deutsche Börse teamed up with Kraken in December to bridge traditional and digital markets and help expedite institutional cryptocurrency adoption in Europe.

What to know:

• Deutsche Börse took a $200 million stake in crypto exchange Kraken's parent Payward Inc., equivalent to a 1.5% stake in the company.
• The investment values the company at around $13.3 billion.
• Kraken announced its aim to go public in November last year, but has reportedly shelved those plans due to...

Bitcoin, ether in Goldilocks rally while smaller coins take a back seat

42 minutes ago

OneCoin victims get a $40 million lifeline more than a decade after the scam began

42 minutes ago

Deutsche Börse takes 1.5% stake in crypto exchange Kraken for $200 million

1 hour ago

Bitcoin tests $75,000 as $200 million in shorts face liquidation risk

1 hour ago

Bank of Korea nominee backs central bank-led digital currency, sees limited role for stablecoins

1 hour ago

Strategy's STRC sees record-breaking trading day, may surpass that on Tuesday

2 hours ago

Here are key bitcoin price levels to watch as the rally gathers steam

3 hours ago

Nikita Bier says crypto has had a rough year, hints at building something new as X Money launch nears

5 hours ago

Ether outpaces bitcoin as ETF flows split and Ethereum activity jumps 41% on-week

7 hours ago

NFT bull Steve Aoki sells his SHIB, ETH, and PEPE. His Bored Apes are down 88%.

5 hours ago

Bearish bets lose $430 million as BTC, ETH surge as much as 7%

7 hours ago

Crypto exchange Kraken targeted in extortion attempt but says there was no breach and no client funds at risk

20 hours ago