{
 "slug": "fake-ledger-live-mac-app-store-9-5m-apr-2026",
 "title": "Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts",
 "url": "https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026",
 "json": "https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026.json",
 "status": "closed",
 "severity": "critical",
 "threatStatus": "partly-contained",
 "verification": "verified",
 "chains": [
  "bitcoin",
  "ethereum",
  "tron",
  "solana"
 ],
 "method": "fake-app",
 "product": "Ledger users who installed 'Ledger Live' from the Mac App Store",
 "tags": [
  "bitcoin",
  "ethereum",
  "tron",
  "solana",
  "fake-app",
  "ledger",
  "app-store",
  "macos",
  "apple",
  "seed-phrase",
  "zachxbt",
  "kucoin"
 ],
 "amountUsd": 9500000,
 "victims": 50,
 "startedAt": "2026-04-08",
 "closedAt": "2026-04-15",
 "updatedAt": "2026-04-15T12:00:00Z",
 "summary": "A fake Ledger Live app for macOS, published on Apple's App Store under the name 'Leva Heal Limited', asked users for their recovery phrase and drained about $9.5M from roughly 50 victims between 8 and 11 April 2026. Apple removed the app and terminated the developer account; KuCoin froze accounts used to launder part of the funds. Ledger's desktop app is only distributed from Ledger's own website, and no Ledger software ever asks for your recovery phrase.",
 "timeline": [
  {
   "date": "2026-04-08",
   "title": "Victims who entered their recovery phrase into the fake app begin losing funds (losses ran 8-11 April).",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto/"
  },
  {
   "date": "2026-04-14",
   "title": "BleepingComputer reports about $9.5M stolen from ~50 victims, traced by ZachXBT and laundered via 150+ KuCoin deposit addresses.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto/"
  },
  {
   "date": "2026-04-15",
   "title": "Apple removes the app and terminates the developer account; KuCoin freezes linked accounts.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto/"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "Fake Ledger Live app on Apple's App Store stole $9.5M in crypto",
   "url": "https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto/",
   "publisher": "BleepingComputer",
   "date": "2026-04-14"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nYou are affected if you installed a 'Ledger Live' app from the Mac App Store (publisher 'Leva Heal Limited') and typed your 24-word recovery phrase into it.\n\n## What to do now\nTreat that recovery phrase as stolen. Reset your Ledger with a new phrase on the device itself and move any remaining funds to it immediately. Delete the fake app. Report the theft to local police and to the exchange where funds landed, with transaction IDs.\n\n## How to avoid this\nDownload Ledger Wallet (Ledger Live) only from ledger.com. Check the publisher name on any store listing. Never type a recovery phrase into a computer or phone app; a hardware wallet only ever asks for it on its own screen during setup or recovery.",
 "notes": null,
 "agentBrief": "# Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts\n\n- Severity: Critical · Status: Partly contained (past)\n- Chains: Bitcoin, Ethereum, Tron, Solana · Method: Fake wallet and trading apps\n- Started: Apr 8, 2026 · Last update: Apr 15, 2026 · Reported stolen: $9.5M · Victims: 50\n- Who/what: Ledger users who installed 'Ledger Live' from the Mac App Store\n\nA fake Ledger Live app for macOS, published on Apple's App Store under the name 'Leva Heal Limited', asked users for their recovery phrase and drained about $9.5M from roughly 50 victims between 8 and 11 April 2026. Apple removed the app and terminated the developer account; KuCoin froze accounts used to launder part of the funds. Ledger's desktop app is only distributed from Ledger's own website, and no Ledger software ever asks for your recovery phrase.\n\n## Am I affected?\nYou are affected if you installed a 'Ledger Live' app from the Mac App Store (publisher 'Leva Heal Limited') and typed your 24-word recovery phrase into it.\n\n## What to do now\nTreat that recovery phrase as stolen. Reset your Ledger with a new phrase on the device itself and move any remaining funds to it immediately. Delete the fake app. Report the theft to local police and to the exchange where funds landed, with transaction IDs.\n\n## How to avoid this\nDownload Ledger Wallet (Ledger Live) only from ledger.com. Check the publisher name on any store listing. Never type a recovery phrase into a computer or phone app; a hardware wallet only ever asks for it on its own screen during setup or recovery.\n\n## Sources\n- Fake Ledger Live app on Apple's App Store stole $9.5M in crypto (BleepingComputer, 2026-04-14): https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto/\n\nFull record: https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026 · JSON: https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}