Key Takeaways
- • A malicious Ledger Live app clone distributed via Apple's App Store drained at least $9.5 million from over 50 victims across Bitcoin, Ethereum, Solana, Tron, and XRP between April 7–13, 2026.
- • Musician G. Love (Garrett Dutton) lost 5.92 BTC (valued at $424,000) after downloading the fraudulent app on his Mac, representing nearly a decade of accumulated savings wiped out in minutes after entering his seed phrase.
- • The fake app used subtle visual deception—including misspellings like "LeddgerLĭve"—to bypass Apple's review process and appeared identical to legitimate Ledger software, exploiting user trust in Apple's curated App Store ecosystem.
- • Three of the largest victims suffered seven-figure losses: $3.23 million in USDT (April 9), $2.08 million in USDC (April 11), and $1.95 million in BTC, ETH, and stETH (April 8), with blockchain investigator ZachXBT tracing funds to KuCoin deposit addresses.
- • Ledger explicitly advises users to download software only from ledger.com and does not distribute through consumer app stores precisely to mitigate this risk, yet Apple's vetting mechanisms failed to catch the malicious clone despite its week-long active distribution.
Summary
A sophisticated phishing campaign exploited Apple's App Store approval process when a fake Ledger Live wallet application circulated from April 7–13, 2026, resulting in documented losses exceeding $9.5 million across multiple blockchain networks. The scam affected more than 50 victims who believed they were downloading legitimate cryptocurrency wallet software from what they perceived as a trusted, curated platform. The incident represents a critical vulnerability in platform security practices where user confidence in institutional gatekeeping was weaponized by attackers.
The most publicly documented victim is musician G. Love (Garrett Dutton of G. Love & Special Sauce), who lost 5.92 BTC representing his entire retirement fund accumulated over a decade. While setting up a new Mac, Dutton downloaded what appeared to be the official Ledger Live application and entered his 24-word seed phrase—the cryptographic equivalent of full account access—directly into the malicious app. Within minutes, his Bitcoin holdings vanished. Blockchain investigator ZachXBT traced the stolen 5.92 BTC through a series of nine transactions directly to KuCoin exchange deposit addresses, confirming the laundering pattern consistent across the broader campaign. Dutton publicly disclosed his loss on X, stating: "I lost my retirement fund in a hack/scam… All my BTC gone in an instant."
The attack's sophistication lay in its visual deception. The fake app used subtle misspellings and near-identical interface design to the legitimate Ledger Live software, making it indistinguishable to users accustomed to Apple's ecosystem reputation for security. Three victims suffered particularly severe losses: $3.23 million in USDT stolen on April 9, $2.08 million in USDC on April 11, and $1.95 million across BTC, ETH, and stETH on April 8. This incident directly contradicts Ledger's own security guidance, which explicitly warns users to download software exclusively from ledger.com and deliberately avoids distribution through consumer app stores to prevent precisely this category of attack. Apple removed the fraudulent app following discovery but has not publicly commented on how the application bypassed its review mechanisms or what remedial measures it is implementing.
The breach exposes a fundamental tension between platform security models and cryptocurrency user behavior. Hardware wallet security depends on protecting seed phrases from any application or service, yet the psychological trust users place in Apple's curation created conditions where victims voluntarily compromised their own security. For institutional investors and family offices managing significant cryptocurrency holdings, this incident reinforces the necessity of hardware wallet discipline: seed phrases should never be entered into software applications regardless of apparent legitimacy, and direct downloads from official publisher websites remain the only defensible distribution model for security-critical software.
The most publicly documented victim is musician G. Love (Garrett Dutton of G. Love & Special Sauce), who lost 5.92 BTC representing his entire retirement fund accumulated over a decade. While setting up a new Mac, Dutton downloaded what appeared to be the official Ledger Live application and entered his 24-word seed phrase—the cryptographic equivalent of full account access—directly into the malicious app. Within minutes, his Bitcoin holdings vanished. Blockchain investigator ZachXBT traced the stolen 5.92 BTC through a series of nine transactions directly to KuCoin exchange deposit addresses, confirming the laundering pattern consistent across the broader campaign. Dutton publicly disclosed his loss on X, stating: "I lost my retirement fund in a hack/scam… All my BTC gone in an instant."
The attack's sophistication lay in its visual deception. The fake app used subtle misspellings and near-identical interface design to the legitimate Ledger Live software, making it indistinguishable to users accustomed to Apple's ecosystem reputation for security. Three victims suffered particularly severe losses: $3.23 million in USDT stolen on April 9, $2.08 million in USDC on April 11, and $1.95 million across BTC, ETH, and stETH on April 8. This incident directly contradicts Ledger's own security guidance, which explicitly warns users to download software exclusively from ledger.com and deliberately avoids distribution through consumer app stores to prevent precisely this category of attack. Apple removed the fraudulent app following discovery but has not publicly commented on how the application bypassed its review mechanisms or what remedial measures it is implementing.
The breach exposes a fundamental tension between platform security models and cryptocurrency user behavior. Hardware wallet security depends on protecting seed phrases from any application or service, yet the psychological trust users place in Apple's curation created conditions where victims voluntarily compromised their own security. For institutional investors and family offices managing significant cryptocurrency holdings, this incident reinforces the necessity of hardware wallet discipline: seed phrases should never be entered into software applications regardless of apparent legitimacy, and direct downloads from official publisher websites remain the only defensible distribution model for security-critical software.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.