A fraudulent Ledger Live app spent six days on Apple’s App Store and stole at least $9.5 million in cryptocurrency from more than 50 victims before being removed on April 13, 2026. The app, published under the name “Leva Heal Limited,” had no connection to Ledger SAS, the French hardware wallet company. It tricked users into entering their seed phrases, giving attackers instant full access to their wallets.
A seed phrase (also called a recovery phrase) is a sequence of 12 to 24 words that serves as a master key to a crypto wallet — anyone who knows it can access and transfer every asset stored inside, across any device, instantly.
- A fake Ledger Live app on Apple’s Mac App Store stole $9.5 million from 50+ victims between April 7 and April 13, 2026.
- Three victims alone lost $3.23M, $2.08M, and $1.95M in a four-day window. Musician G. Love lost 5.9 BTC ($430,000), his decade-long retirement savings.
- Stolen funds were laundered through 150+ KuCoin deposit addresses using a mixing service called AudiA6. KuCoin froze the accounts, but the freeze expires April 20 without a law enforcement extension.
- Ledger Live has no official Apple App Store listing. The legitimate software is only available at ledger.com.
Published: April 14, 2026 UTC
How a fake app passed App Store review
The fraudulent app was submitted under “Leva Heal Limited,” an entity unrelated to Ledger. To build the appearance of legitimacy, the attackers pushed rapid version updates from 1.0 to 5.0 in roughly two weeks, a pattern designed to signal active development and surface the app higher in search results.
Once installed, the app prompted users to enter their seed phrases, claiming it was needed to “sync” their hardware wallet. That data went directly to the attackers. Apple has not publicly explained how the app passed its review process. The app was available on the Mac App Store, not the iOS App Store — a distinction that may matter for any future legal action.
Blockchain investigator ZachXBT documented the attack on X and traced the three largest individual losses: $3.23 million in USDT drained on April 9, $2.08 million in USDC on April 11, and $1.95 million in BTC, ETH, and stETH on April 8. Total victims exceeded 50 across Bitcoin, Ethereum, Tron, Solana, and Ripple.
The laundering trail and the closing window
Funds from all victims were routed through more than 150 deposit addresses on KuCoin and funneled into a centralized mixing service called AudiA6, known for high fees and obfuscation of illicit flows. KuCoin has confirmed it froze the associated accounts, but that freeze expires April 20 unless law enforcement formally requests an extension.
ZachXBT has suggested the pattern of losses may be sufficient grounds for a class-action lawsuit against Apple, though no filing has been confirmed as of this writing.
One prominent victim, Philadelphia musician Garrett Dutton (known as G. Love), publicly shared his experience on X. Dutton lost 5.9 BTC — roughly $430,000 at current prices — that he had accumulated over a decade and held as retirement savings. He said he downloaded the app while setting up a new MacBook, believing it was official Ledger software.
Why this keeps happening
Ledger Live does not have an official listing on the Apple App Store. The company distributes its software exclusively through its own website at ledger.com. This gap is not a secret, but it creates a credible-looking attack surface: anyone searching “Ledger Live” in the App Store before the removal would have found the fraudulent app with no competing official result.
This is not the first Ledger-impersonator incident on app platforms. A similar fake Ledger app appeared on the Microsoft Store in November 2023 and reportedly stole around $768,000. Apple and Google have faced repeated criticism for slow or inconsistent enforcement against crypto wallet impersonators.
The incident follows a broader Q1 2026 trend. Blockchain security firm Hacken reported that phishing and key compromises have now overtaken smart contract exploits as the primary vector for Web3 losses, accounting for $306 million of the $482 million lost across all Web3 incidents in the first quarter of this year.
What affected users should do now
Anyone who downloaded a Ledger app from the Mac App Store between March 30 and April 13, 2026 should assume their seed phrase is compromised. The correct response is to create a new wallet with a fresh seed phrase on a trusted device, then transfer all assets to the new wallet immediately — before doing anything else with the affected accounts. Reporting to both Apple and local law enforcement creates a paper trail that may support any civil recovery effort.
Does Ledger Live have an official Apple App Store listing?
No. Ledger distributes Ledger Live exclusively through its own website at ledger.com. Any Ledger-branded app found on the Apple App Store or Microsoft Store should be treated as fraudulent until confirmed otherwise directly with Ledger’s support team.
My seed phrase was entered into the fake app. What should I do?
Create a brand-new wallet with a freshly generated seed phrase on a clean device. Transfer all assets from your compromised wallet to the new address immediately. Your old seed phrase must be considered permanently exposed — there is no way to revoke it.
Is KuCoin’s account freeze permanent?
No. KuCoin announced the freeze on accounts linked to the theft, but confirmed it expires April 20, 2026 unless extended by a formal law enforcement request. Victims should contact law enforcement now to maximize the chance of a freeze extension before that deadline.
