{"id":45452,"date":"2026-04-16T07:44:10","date_gmt":"2026-04-15T23:44:10","guid":{"rendered":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/2026\/04\/16\/fake-ledger-live-app-on-apple-store-linked-to-9-5m-crypto-theft\/"},"modified":"2026-04-16T07:44:10","modified_gmt":"2026-04-15T23:44:10","slug":"fake-ledger-live-app-on-apple-store-linked-to-9-5m-crypto-theft","status":"publish","type":"post","link":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/2026\/04\/16\/fake-ledger-live-app-on-apple-store-linked-to-9-5m-crypto-theft\/","title":{"rendered":"Fake Ledger Live App on Apple Store Linked to $9.5M Crypto Theft"},"content":{"rendered":"\n

A fake application posing as \u201cLedger Live\u201d on the Apple App Store<\/a> has been linked to more than $9.5 million in cryptocurrency theft, affecting over 50 users within just one week.<\/p>\n

The activity was identified by blockchain investigator ZachXBT<\/a>, who reported that the incidents occurred between April 7 and April 13, with victims losing funds on multiple networks, including Bitcoin, Ethereum, Solana, Tron, and XRP. This indicates a large-scale attack rather than a chain-specific exploit.<\/p>\n

App Masqueraded as Legitimate Wallet Software<\/strong><\/h3>\n

The malicious app mimicked the official Ledger Live interface and branding, presenting itself as a standard wallet management tool. It was listed under the developer name \u201cSAS Software Company\u201d and published by \u201cLeva Heal Limited.\u201d<\/p>\n

The listing included positive user reviews and standard App Store metadata such as a business category label, age rating, and privacy disclosures claiming no data collection. These elements contributed to its credibility and likely reduced user suspicion.<\/p>\n

Users who downloaded the app were prompted to input sensitive wallet information, which was then used to access and drain funds from their accounts.<\/p>\n

\n
\"Fake<\/a>
The fake Ledger live app, its developers’ details, and fake positive reviews (Via: ZachXBT)<\/figcaption><\/figure>\n<\/p><\/div>\n

Funds Routed Through Exchanges and Mixing Services<\/strong><\/h3>\n

According to ZackXBT’s transaction analysis<\/a> on Telegram, stolen assets were transferred through a network of intermediary wallets before being consolidated into more than 150 deposit addresses associated with the crypto exchange KuCoin<\/a>.<\/p>\n

Following this step, the funds were sent through a centralized mixing service known as \u201cAudiA6,\u201d which charges high fees to make the transactions difficult to trace. This process complicates tracking and recovery efforts.<\/p>\n

ZachXBT also identified several wallet addresses across multiple blockchains where the stolen funds were first sent. Among the reported cases, several victims experienced losses exceeding seven figures.<\/p>\n