App Store's Latest DApp? A $9.5M Heist in Disguise

Apple just yanked a fake Ledger Live app that managed to drain $9.5 million from over 50 crypto users — because nothing says "self-custody" like handing your seed phrase to a glorified phishing page with a nice UI.

The rogue app, linked to a developer Apple identified as "SAS Software Company," pulled off a classic bait-and-switch: get approved for something harmless, then quietly pivot to impersonating Ledger Live. Once live, it tricked users into installing malware and surrendering their seed phrases — the digital equivalent of mailing someone your house keys, bank PIN, and social security number in a cheerful greeting card.

According to blockchain investigator ZachXBT, the scam hit hardest between April 7 and 13. Losses were anything but small change: one user lost $3.23 million in USDT, another $2 million in USDC, and a third coughed up $1.95 million worth of BTC, ETH, and staked ETH. And in a twist that adds rhythm to tragedy, musician G. Love — real name Garrett Dutton — confirmed he lost $420,000 in Bitcoin. (Poetic, if you're into ironic numerology.)

Apple says it terminated the developer and has been battling these bait-and-switch tactics for over a decade — dating back to a 2013 Pokémon Yellow knockoff that somehow passed as acceptable entertainment. In 2024 alone, Apple axed over 17,000 apps for similar deception, rejected 320,000 spammy submissions, and blocked 37,000 potentially fraudulent apps. At this point, Apple's fraud team probably has trust issues even with their own App Store review team.

Yet here we are. The moral? Even in Web3, never trust an app that looks too good — or too official — to be true. And maybe, just maybe, keep your seed phrase as far from your App Store downloads as possible.