A sophisticated crypto scam posing as the official Ledger Live hardware wallet app successfully passed Apple's App Store review process and drained at least $9.5 million from more than 50 victims between April 7 and April 13. According to reports from Peace Longe, the stolen funds were routed through more than 150 KuCoin deposit addresses and into a centralized mixing service called AudiA6. The three largest individual thefts included $3.23 million in USDT on April 9, $2.08 million in USDC on April 11, and $1.95 million in BTC, ETH, and stETH on April 8.
The attack mechanism exploited social trust by appearing in search results for 'Ledger Live' with convincing branding and a standard setup flow. As reported by Peace Longe, the fake app prompted users to enter their 24-word seed phrase during what appeared to be a normal wallet setup flow. Once a seed phrase is entered into any connected application, attackers gain full and immediate control of every wallet derived from it. One notable victim was Philadelphia musician Garrett Dutton of G. Love and Special Sauce, who lost 5.92 BTC accumulated over a decade of saving while setting up his Ledger hardware wallet on a new MacBook.
The incident highlights significant security gaps in Apple's review process, as reported by Peace Longe. Apple has removed the fake app from the App Store but has not publicly commented on how it passed the review process. Security experts note that Apple's review process, which has rejected crypto apps for policy reasons, apparently did not catch a malicious application designed to steal funds from users of hardware wallets that Apple's own policies pushed them toward using. The attack exploited the trust users have in Apple's App Store as a legitimate source for applications.
Recovery of the stolen funds appears unlikely due to their routing through the AudiA6 mixing service, as reported by Peace Longe. KuCoin has been barred from onboarding new EU users by Austrian regulators in February 2026, just three months after receiving a MiCA license, and previously paid over $300 million to US authorities in 2025 to settle anti-money laundering violations. The incident has prompted discussion of potential class-action lawsuits against Apple for platform liability, reinforcing why crypto security experts consistently warn against downloading wallet software from any source other than the manufacturer's official website.
