Fake Ledger Live app on Apple App Store stole $9.5M from 50 crypto victims

A malicious Ledger Live app for macOS available on Apple's App Store drained approximately $9.5 million in cryptocurrency from 50 victims over several days this month, according to blockchain investigators. Users who downloaded the fake application were tricked into entering their seed phrases, giving attackers full access to their wallets. The stolen funds were moved across multiple blockchains including Bitcoin, Ethereum, Tron, Solana, and Ripple, then laundered through more than 150 deposit addresses on the KuCoin exchange linked to a mixing service called "AudiA6." Three individual victims lost seven-figure amounts between April 8 and April 11, with losses of $3.23 million, $2.08 million, and $1.95 million. Musician G. Love reported losing 5.9 BTC after downloading the app, a loss confirmed by blockchain investigator ZachXBT. The fake app was submitted to the Apple App Store under publisher name 'Leva Heal Limited,' which has no association with the legitimate Ledger development team. Apple has since removed the malicious application following multiple user reports. KuCoin announced it has frozen accounts involved in the scheme until April 20, though the freeze could be extended with official law enforcement requests. Notably, Ledger offers a Mac app through its website but not on the Apple App Store, where only an iOS-compatible version is available. This availability gap has been exploited by threat actors before, including a 2023 incident targeting the Microsoft Store that resulted in $768,000 in stolen cryptocurrency.