Kaspersky finds 26 'FakeWallet' apps on Apple's App Store stealing wallet recovery phrases
iPhone users who installed fake MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken or Bitpie apps
Kaspersky found 26 decoy apps on Apple's App Store (games, calculators, to-do lists) that opened a fake App Store page and pushed users to sideload trojanized versions of MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken and Bitpie. The trojanized hot wallets captured recovery phrases during wallet creation or restore, and the Ledger lure asked for the phrase directly. The campaign ran since at least fall 2025, mostly against users in China, and is attributed with moderate confidence to the SparkKitty actors; Kaspersky reported all apps to Apple. No loss total was published.
Why this severity: Only partly contained, many people exposed.
- Started
- Apr 20, 2026
- Closed
- Apr 20, 2026
- Chains
- Multiple EVM chains, Bitcoin, Tron
At risk
- iPhone users who installed fake MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken or Bitpie apps
- Multiple EVM chains wallets
- Bitcoin wallets
- Tron wallets
What to do now
- Create a new wallet with a new recovery phrase in the official app and move all funds there. Remove the fake wallet and any developer profile you did not get from your employer (Settings > General > VPN & Device Management). Delete the decoy app.
Stay safe
Am I affected?
You may be affected if an App Store game, calculator or to-do app sent you to a page offering a crypto wallet download, or asked you to install a developer profile, and you then created or restored a wallet in that app.
What to do now
Create a new wallet with a new recovery phrase in the official app and move all funds there. Remove the fake wallet and any developer profile you did not get from your employer (Settings > General > VPN & Device Management). Delete the decoy app.
How to avoid this
Install wallets only through links on the wallet maker's official website. Never install a configuration or developer profile to get an app. Only enter a hardware-wallet recovery phrase on the device itself; Ledger's app never asks for it.
Timeline 1
Kaspersky discloses 26 FakeWallet apps on the App Store, active since at least fall 2025, and reports them to Apple.
Source
Alerts & on-chain evidence 1
How this method works
Look-alike apps on app stores or download sites that steal your seed phrase or show a fake balance while keeping your deposits. Read about fake wallet and trading apps →
Follow new drains and updates in your feed reader or Telegram RSS bot.