Fake crypto app on Apple App Store linked to $23K wallet theft
A fake cryptocurrency trading app called Padre Terminal, previously available on the Apple App Store for iOS devices, has been linked to the theft of about $23,000 from 27 Solana wallets.
A fake cryptocurrency trading app called Padre Terminal, previously available on the Apple App Store for iOS devices, has been linked to the theft of about $23,000 from 27 Solana wallets.
The researcher says the app drains wallets after unsuspecting users import their private keys into it.
In March 2024, a fake Leather cryptocurrency wallet app appeared on the Apple App Store, and multiple users reported losing their assets after connecting their wallets to it.
Blockchain investigator Iris confirmed that one victim was compromised through the malicious App Store app, but has not determined how the other affected wallets were compromised.
Iris told BleepingComputer it suspects the trading interface of the fake app is served remotely, but has not directly observed the wallet-draining screen.
Iris identified at least five suspected crypto-brand impersonators on the App Store, including Padre Terminal, Axiom Pro: Focus, GMGN AI, HyperTerminal-HyperliquidTools, and Pump Fun Tokens & Analitycs.
A review of the GMGN AI app alleged that $2,000 had been stolen, while a review associated with HyperTerminal-HyperliquidTools reported the theft of $2,020.
The stolen cryptocurrency was traced to the Solana address 3LAgKYoNenWrGWT3U4XWhpgVJWyYkP9wKpiPk8TJT1LN .
It was later renamed Terminal by pump.fun, a platform focused on creating, buying, and selling cryptocurrency “meme coins” on the Solana blockchain.
Another app, Pump Fun Tokens & Analitycs, presented itself as a notes application but had a review explicitly accusing it of stealing cryptocurrency.
What happened
A fake cryptocurrency trading app called Padre Terminal, previously available on the Apple App Store for iOS devices, has been linked to the theft of about $23,000 from 27 Solana wallets.
The researcher says the app drains wallets after unsuspecting users import their private keys into it.
What changed
In March 2024, a fake Leather cryptocurrency wallet app appeared on the Apple App Store, and multiple users reported losing their assets after connecting their wallets to it.
Blockchain investigator Iris confirmed that one victim was compromised through the malicious App Store app, but has not determined how the other affected wallets were compromised.
Who is affected
Iris told BleepingComputer it suspects the trading interface of the fake app is served remotely, but has not directly observed the wallet-draining screen.
Iris identified at least five suspected crypto-brand impersonators on the App Store, including Padre Terminal, Axiom Pro: Focus, GMGN AI, HyperTerminal-HyperliquidTools, and Pump Fun Tokens & Analitycs.
Why it matters
A review of the GMGN AI app alleged that $2,000 had been stolen, while a review associated with HyperTerminal-HyperliquidTools reported the theft of $2,020.
The stolen cryptocurrency was traced to the Solana address 3LAgKYoNenWrGWT3U4XWhpgVJWyYkP9wKpiPk8TJT1LN .
Technical details
It was later renamed Terminal by pump.fun, a platform focused on creating, buying, and selling cryptocurrency “meme coins” on the Solana blockchain.
Another app, Pump Fun Tokens & Analitycs, presented itself as a notes application but had a review explicitly accusing it of stealing cryptocurrency.
Response
According to Iris, the two wallets held a combined 229.66 SOL, with no funds cashed out at the time of the researcher's update, and at the time of BleepingComputer's initial investigation, we found two Padre apps on the App Store (ID 6802739263 and ID 6717572591).
What security teams should do
Apple eventually removed the app two weeks later and blocked the publisher from its developer program; the Axiom Pro: Focus app, for example, had about 25 user reviews alleging wallet theft since February.
Attribution
BleepingComputer: A fake cryptocurrency trading app called Padre Terminal, previously available on the Apple App Store for iOS devices, has been linked to the theft of approximately $23,000 from 27 Solana wallets.