Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts
Ledger users who installed 'Ledger Live' from the Mac App Store
A fake Ledger Live app for macOS, published on Apple's App Store under the name 'Leva Heal Limited', asked users for their recovery phrase and drained about $9.5M from roughly 50 victims between 8 and 11 April 2026. Apple removed the app and terminated the developer account; KuCoin froze accounts used to launder part of the funds. Ledger's desktop app is only distributed from Ledger's own website, and no Ledger software ever asks for your recovery phrase.
Why this severity: $9.5M reported stolen, 50 victims, only partly contained.
- Started
- Apr 8, 2026
- Closed
- Apr 15, 2026
- Reported stolen
- $9.5M
- Victims
- 50
At risk
- Ledger users who installed 'Ledger Live' from the Mac App Store
- Bitcoin wallets
- Ethereum wallets
- Tron wallets
- Solana wallets
What to do now
- Treat that recovery phrase as stolen. Reset your Ledger with a new phrase on the device itself and move any remaining funds to it immediately. Delete the fake app. Report the theft to local police and to the exchange where funds landed, with transaction IDs.
Stay safe
Am I affected?
You are affected if you installed a 'Ledger Live' app from the Mac App Store (publisher 'Leva Heal Limited') and typed your 24-word recovery phrase into it.
What to do now
Treat that recovery phrase as stolen. Reset your Ledger with a new phrase on the device itself and move any remaining funds to it immediately. Delete the fake app. Report the theft to local police and to the exchange where funds landed, with transaction IDs.
How to avoid this
Download Ledger Wallet (Ledger Live) only from ledger.com. Check the publisher name on any store listing. Never type a recovery phrase into a computer or phone app; a hardware wallet only ever asks for it on its own screen during setup or recovery.
Timeline 3
Apple removes the app and terminates the developer account; KuCoin freezes linked accounts.
SourceBleepingComputer reports about $9.5M stolen from ~50 victims, traced by ZachXBT and laundered via 150+ KuCoin deposit addresses.
SourceVictims who entered their recovery phrase into the fake app begin losing funds (losses ran 8-11 April).
Source
News & write-ups ›1
How this method works
Look-alike apps on app stores or download sites that steal your seed phrase or show a fake balance while keeping your deposits. Read about fake wallet and trading apps →
Follow new drains and updates in your feed reader or Telegram RSS bot.