Fake Ledger Live app on Apple's Mac App Store steals about US$9.5 million in crypto from 50+ people
A fake Ledger Live app on the Mac App Store tricked 50+ people into entering wallet recovery phrases, costing about US$9.5M (7-13 April). Apple removed it. Never type a recovery phrase into any app; get Ledger software only from ledger.com.
Never type your recovery phrase into any app, website or support chat. Download Ledger Live only from ledger.com. If you entered a phrase into a Mac App Store version, move your funds to a new wallet with a new recovery phrase using a hardware device you trust, straight away.
What’s happening
A counterfeit version of Ledger Live, the software used to manage Ledger hardware crypto wallets, was published on Apple's Mac App Store and asked users to enter their wallet recovery (seed) phrase. Anyone who did handed over full control of their wallet. Blockchain investigator ZachXBT estimated that more than 50 victims lost about US$9.5 million between 7 and 13 April 2026, with at least three people losing about US$2 million or more each. Musician G. Love said he lost around 5.9 BTC. The stolen crypto was moved across Bitcoin, Ethereum, Tron, Solana and XRP and traced to more than 150 KuCoin deposit addresses tied to a mixing service. Apple told Cointelegraph it removed the app and terminated the developer's account for a bait-and-switch scheme; the press reports disagree on the developer's name. The reports say removal came after the losses. KuCoin froze some accounts, but only temporarily. None of the pages read reports any recovery of funds, arrests or charges, and Ledger had not issued a public statement in them. Ledger does not sell its Mac app through the App Store.
- What
- Scam
- Affects
- Fake Ledger Live app on Apple's Mac App Store
- Fixed in
- Nothing to patch
- Since
- 7 Apr 2026
- Closed
- 15 Apr 2026
Timeline
- UpdateNothing to patch
Apple told Cointelegraph it had removed the app and terminated the developer's account for a bait-and-switch scheme. Apple named the developer as SAS Software Company; Reddit users cited by BleepingComputer named it Leva Heal Limited. Reports say KuCoin froze accounts tied to the funds, but only temporarily, until 20 April unless law enforcement asked for an extension.
- UpdateNothing to patch
BleepingComputer and Decrypt reported that more than 50 victims lost about US$9.5 million after typing wallet recovery phrases into the app. Funds were traced to more than 150 KuCoin deposit addresses linked to a mixing service. Musician G. Love said he lost about 5.9 BTC.
- Made publicNothing to patch
A counterfeit Ledger Live app, posing as Ledger's wallet software, was live on Apple's Mac App Store. Blockchain investigator ZachXBT later dated the thefts from 7 April.
Sources
- Fake Ledger Live app on Apple's App Store stole $9.5M in cryptoBleepingComputer · 14 Apr 2026
- Fake Ledger App Steals Millions in Bitcoin, Crypto From Holders, Including Musician G. LoveDecrypt · 14 Apr 2026
- Apple removes fake Ledger app that stole millions from usersCointelegraph · 15 Apr 2026