{
 "tag": "app-store",
 "name": "App Store",
 "group": "Platforms & channels",
 "incidents": [
  {
   "slug": "kaspersky-fakewallet-26-ios-apps-apr-2026",
   "title": "Kaspersky finds 26 'FakeWallet' apps on Apple's App Store stealing wallet recovery phrases",
   "url": "https://drains.watch/i/kaspersky-fakewallet-26-ios-apps-apr-2026",
   "json": "https://drains.watch/i/kaspersky-fakewallet-26-ios-apps-apr-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "multi-evm",
    "bitcoin",
    "tron"
   ],
   "method": "fake-app",
   "product": "iPhone users who installed fake MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken or Bitpie apps",
   "tags": [
    "multi-evm",
    "bitcoin",
    "tron",
    "fake-app",
    "ios",
    "app-store",
    "kaspersky",
    "sparkkitty",
    "metamask",
    "ledger",
    "trust-wallet",
    "coinbase",
    "seed-phrase",
    "developer-profile"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-04-20",
   "closedAt": "2026-04-20",
   "updatedAt": "2026-04-20T12:00:00Z",
   "summary": "Kaspersky found 26 decoy apps on Apple's App Store (games, calculators, to-do lists) that opened a fake App Store page and pushed users to sideload trojanized versions of MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken and Bitpie. The trojanized hot wallets captured recovery phrases during wallet creation or restore, and the Ledger lure asked for the phrase directly. The campaign ran since at least fall 2025, mostly against users in China, and is attributed with moderate confidence to the SparkKitty actors; Kaspersky reported all apps to Apple. No loss total was published."
  },
  {
   "slug": "fake-ledger-live-mac-app-store-9-5m-apr-2026",
   "title": "Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts",
   "url": "https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026",
   "json": "https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "bitcoin",
    "ethereum",
    "tron",
    "solana"
   ],
   "method": "fake-app",
   "product": "Ledger users who installed 'Ledger Live' from the Mac App Store",
   "tags": [
    "bitcoin",
    "ethereum",
    "tron",
    "solana",
    "fake-app",
    "ledger",
    "app-store",
    "macos",
    "apple",
    "seed-phrase",
    "zachxbt",
    "kucoin"
   ],
   "amountUsd": 9500000,
   "victims": 50,
   "startedAt": "2026-04-08",
   "closedAt": "2026-04-15",
   "updatedAt": "2026-04-15T12:00:00Z",
   "summary": "A fake Ledger Live app for macOS, published on Apple's App Store under the name 'Leva Heal Limited', asked users for their recovery phrase and drained about $9.5M from roughly 50 victims between 8 and 11 April 2026. Apple removed the app and terminated the developer account; KuCoin froze accounts used to launder part of the funds. Ledger's desktop app is only distributed from Ledger's own website, and no Ledger software ever asks for your recovery phrase."
  }
 ],
 "changes": [
  {
   "incident": "kaspersky-fakewallet-26-ios-apps-apr-2026",
   "incidentTitle": "Kaspersky finds 26 'FakeWallet' apps on Apple's App Store stealing wallet recovery phrases",
   "severity": "high",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-04-20",
   "title": "Kaspersky discloses 26 FakeWallet apps on the App Store, active since at least fall 2025, and reports them to Apple.",
   "sourceUrl": "https://www.kaspersky.com/about/press-releases/kaspersky-finds-26-fake-crypto-wallet-apps-on-apples-app-store-that-can-drain-digital-assets",
   "url": "https://drains.watch/i/kaspersky-fakewallet-26-ios-apps-apr-2026"
  },
  {
   "incident": "fake-ledger-live-mac-app-store-9-5m-apr-2026",
   "incidentTitle": "Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-04-15",
   "title": "Apple removes the app and terminates the developer account; KuCoin freezes linked accounts.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto/",
   "url": "https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026"
  },
  {
   "incident": "fake-ledger-live-mac-app-store-9-5m-apr-2026",
   "incidentTitle": "Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-04-14",
   "title": "BleepingComputer reports about $9.5M stolen from ~50 victims, traced by ZachXBT and laundered via 150+ KuCoin deposit addresses.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto/",
   "url": "https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026"
  },
  {
   "incident": "fake-ledger-live-mac-app-store-9-5m-apr-2026",
   "incidentTitle": "Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-04-08",
   "title": "Victims who entered their recovery phrase into the fake app begin losing funds (losses ran 8-11 April).",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto/",
   "url": "https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026"
  }
 ]
}