Bogus crypto wallet on App Store steals $9.5M

[_act_]

It started with a fake Ledger Live app on App store for macOS users, between April 8 and April 11, three different victims lost $3.23 million, $2.08 million and $1.95 million. But in total, the thieves were able to take around $9.5 million from over 50 people before Apple deleted the app.

The fake app was able to steal peoples bitcoin, ethereum, tron, solana, ripple and other cryptocurrencies before the fake app was taken down.

I am very sure that the app would have just little number of downloads which would be a huge reason to know that it is fake. Another thing is that it is better you go to Ledger website to download necessary apps. This is a very simple mistake that can be avoided.

Why are people making use of cryptocurrencies but they do not learn about how to protect themselves from bad people that can steal their cryptocurrencies.

I am not saying Ledger is a good wallet, but this is just an awareness again that we should learn how to protect our cryptocurrencies.

https://appleinsider.com/articles/26/04/14/bogus-crypto-wallet-on-app-store-steals-95m

[DYING_S0UL]

It started with a fake Ledger Live app on App store for macOS users, between April 8 and April 11, three different victims lost $3.23 million, $2.08 million and $1.95 million. But in total, the thieves were able to take around $9.5 million from over 50 people before Apple deleted the app.

The fake app was able to steal peoples bitcoin, ethereum, tron, solana, ripple and other cryptocurrencies before the fake app was taken down.

I am very sure that the app would have just little number of downloads which would be a huge reason to know that it is fake. Another thing is that it is better you go to Ledger website to download necessary apps. This is a very simple mistake that can be avoided.

Another hack related to apple's appstore or android's playstore? Man not again!...if these official sources are not secure, I don't know what really are..this is really alarming.

We used to advise people that don't download and install apps from unknown sources, now we'll be advising that don't download anything from official app/play stores... ironic, isn't it?

Now comes the last part, which is the Ledger website. With so many phishing websites close to 99.99 identical to the original, sometimes users cannot but fall for the fake ones. With simple google searching, it becomes dangerous if we are not paying enough attention. Moreover, we should verify the websites once and bookmark them for forever, to avoid accidents.

[Free Market Capitalist]

It’s not enough to just download a fake app. As I saw on another site, the problem is that those apps asked users to enter their private keys on their computers, and some unsuspecting people fell for the scam, as the article linked by the OP also points out:

As BleepingComputer points out, the malicious Ledger Live app tricked 50 macOS users into giving away their seed and recovery phrases, which let bad actors take their funds in a matter of days.

Basically, if you’re careful about where you download apps from, and—most importantly—NEVER write your private keys on your computer (only on the USB drive), you’ll be safe from these scams.

[hugeblack]

Overconfidence may be the reason, as there is a false sense of security through the use of the Apple Store and Hardware wallet.
the targeted amounts seem larger than just downloading a random app on the Apple Store; they may be part of larger social attacks.

[tech30338]

This is why I Always check what im going to download in my app if its seems off its not going, and if this app seems like slowing my unit, for some reason not going to use it, although the first thing should do first is check the app you are going to install.
Some people is correct too confident that where we download is safe, but in reality, those were not totally check and some will make it in the list of application with a hidden agenda on it, to steal, so it be phone or computer, if we are dealing with big amount we should invest on the most safest hardware if needed no questions ask.

[Outhue]

Something similar has been discussed already on this forum but I guess the numbers of victims are growing, because this amount isn't what the other have lost.

https://bitcointalk.org/index.php?topic=5580115.msg66611016#msg66611016

The only thing that hardware wallets needs to come up with as a solution to battle this scam is to never release any hardware wallet app into the market, app store, it should be officially available on the website only, no Playstore, no Apple store.

If they want this to be even more effective they should make hardware wallets that doesn't need apps to operate separately, if all hardware wallets can be operated in the device itself without the need of apps it will help alot, although this type of scam is users own mistakes, something that can be avoided if they truly understand the right way to operate and use a hardware wallet.

[Zaguru12]

Overconfidence may be the reason, as there is a false sense of security through the use of the Apple Store and Hardware wallet.
the targeted amounts seem larger than just downloading a random app on the Apple Store; they may be part of larger social attacks.

This is it, overconfidence about the whole thing, I could remember that in the past Apple Store doesn’t allows much of this recent applications been on their store without strict scrutiny and then it got praises but that is very the case for any of them now. The rule remains that you should simply go to the right source, verify file signature if it’s available. But most of the time people are too casual taking their wallet security serious.

Yes it’s a larger social engineering attacks that might have even included phishing attacks. Also one thing is all those reviews we see on an app are usually manipulated as it is mostly fake reviews which is done by a group of scammers themselves.

It’s not enough to just download a fake app. As I saw on another site, the problem is that those apps asked users to enter their private keys on their computers, and some unsuspecting people fell for the scam,

It’s definitely going to be a trick to reveal their keys, just downloading an application can not steal your keys directly from the wallet, the scam is you are asked to enter your recovery seed phrase or private key for recovery or asked to sign a phishing message. One thing people usually use to get carried away with.  This is a cold wallet it would never ask for keys on its live wallet app

[Peanutswar]

After with these recent issues with the App store of having a fake application which is submitted to their platform I guess the security and the approval of the Apple are getting weaken, before Im into Apple product because they are restricted when it comes with the release of an application to their paltform because of the security check they have been used to but right now ive seen not only this post but also into the other forum that there are people getting victim if downloading with this fake crypto wallets. Now one of my practices are into direct visiting their legit website and there is a shortcut most likely to their platform once you click the download it will re-direct you if its for android, ios or desktop. But still there is a risk possible visiting a wrong website but of course you will bookmarks the legit one.

[Nathrixxx]

I think I recently came across a thread that also suggests why we should be more careful with the use of Play Store apps, because some could render a vulnerability to us that could lead to pain attacked, we only have to be more careful not to download outside what we intended to get from some of these apps on their Play store, today you can discover a lot of arts that are similar names. We may not be able to verify their source until you download them to discover that they are not the target one we intended.

[YellowSwap]

It's so obvious that app stores aren't doing a great job scrutinizing every apps that want to get listed on their platforms, I don't really blame them, many people have lost alot of money because they chose to search for apps on app stores and ended up with fake apps.

It seems that many people are still not aware that every app stores have fake apps in them, if not no one will still be falling for this scams today, it's really a shame that this still happens till today.

How many people are we going to keep talking to abandon appstores? When nothing this heartbreaking haven't happened to them yet? People only learn after a bad experience, unfortunately.

[Davidvictorson]

Why are people making use of cryptocurrencies but they do not learn about how to protect themselves from bad people that can steal their cryptocurrencies.

I am not saying Ledger is a good wallet, but this is just an awareness again that we should learn how to protect our cryptocurrencies.

https://appleinsider.com/articles/26/04/14/bogus-crypto-wallet-on-app-store-steals-95m

This is a very important question. One of the reasons I can guess is that people are still yet to understand what it really means to not trust but verify. For many, it is just a statement until they become victims of hacks and scams then they take the statement literally.
Secondly, I don’t know whether to say the AppStore as well as PlayStore has failed us because they don’t do their due diligence enough on apps they allow on their sites. But then, some of these app developers with ulterior motives are really good at hiding their true intentions. So the blame is not completely to the app stores.

[Razmirraz]

Overconfidence may be the reason, as there is a false sense of security through the use of the Apple Store and Hardware wallet.
the targeted amounts seem larger than just downloading a random app on the Apple Store; they may be part of larger social attacks.

Overconfidence arises because Apple is known to have a tight security system, but the App Store can still be infiltrated by fake or malicious applications because not all security holes can be detected in the review process, especially fraudsters using sophisticated techniques to trick the application review process. Typically some apps are specifically designed to enable malicious features in certain geographic regions or after a certain period of time. In fact, the victims are completely unaware that they have fallen into a fraudster's trap because the application is exactly the same as popular applications in general, they imitate the design, name, icon and description of popular applications to trick victims into downloading them.

Typically, fake app developers often use tricks (Bait-and-Switch), initially they submit a version of the app that looks safe, legitimate, and functional to pass Apple's review process. Once the duplicate app is approved and available on the App Store, they start tampering with the app to update it with malicious code (malware) or fraudulent features.

Wallet security is the most crucial point for crypto users, this is in line with the concept of (Be Your Own Bank), meaning that security responsibility lies entirely with the owner. Crypto users should have a distrustful approach to certain applications before verifying them. So the basic rule is to always download from the official link of the wallet project website.

[Rikafip]

We used to advise people that don't download and install apps from unknown sources, now we'll be advising that don't download anything from official app/play stores... ironic, isn't it?

Afaik that was always advice, not to download anything important from app stores, and instead directly from the official website. Then again, those who fall for something like this by downloading a fake app could very easily end up on phishing website, resulting with the same thing.

Why are people making use of cryptocurrencies but they do not learn about how to protect themselves from bad people that can steal their cryptocurrencies

Maybe I am naive, but I like to think that many of these type of losses happen simply due being in a rush (or distracted) and not taking enough time to check if app is legit. I know some people that are very far from newbs, yet they manage to lose large amounts simply because of rushing.

[CryptSafe]

I have realized that it is not just about talking about all these fake wallet apps and websites, but also about how we make the rest of the community members, including the newbies, know a lot about these fake wallets and websites, so they do not make any mistakes when encountering any of them.

As a community member here, I will suggest that a thread or board be created by Theymos, specifically for anything fake as it relates to crypto and bitcoin. They can be informed as it relates to trending scams, hacks, phishing attacks, dusting, and other topics as it relates to physical and other aspects of crypto scams and hacks.

[AakZaki]

Starting from macOS or Apple, expensive devices that were predicted to have a better level of security, now make the loss of assets up to $9.5 million.
In addition to the carelessness of the users themselves, Apple itself passed the application, why the Apple team did not really verify that the application was legitimate.

Supposedly, if it involves finance or valuable assets such as Crypto, the Apple team must verify thoroughly such as verifying that it is part of a legitimate company or in this case a Ledger company.
If it happens like this now, it is as if the Apple team is just taking the cost of hosting the app on its AppStore.

It's unfortunate that this kind of case can tarnish his big name, because maybe some people will think that Apple is no longer safe.

[_act_]

Starting from macOS or Apple, expensive devices that were predicted to have a better level of security, now make the loss of assets up to $9.5 million.
In addition to the carelessness of the users themselves, Apple itself passed the application, why the Apple team did not really verify that the application was legitimate.

People will be saying that Apple is better than Windows in protecting their users but this let us know that all those talks are just deceitful. If someone is using something that is online, they should be guarded and be expecting something like this to happen. All those operating system providers can not always be protecting their users. We have seen many vulnerabilities in the operating systems and also there have been many malware on their Stores but people are not ready to learn until they learn in the hard way after they have been scammed or after their coins are stolen.

[michellee]

People should care with their assets and make sure download from the source site. It is important lesson to all, not just for Apple company or the users but also for all so we should checking on the source site if we see an app use the site name or similar.

We can't download before verify if that is real or fake. Being online means we should be more careful. We don't know who will steal from us. Make sure by verify and research before doing something.

[KiaKia]

It’s not enough to just download a fake app. As I saw on another site, the problem is that those apps asked users to enter their private keys on their computers, and some unsuspecting people fell for the scam, as the article linked by the OP also points out:

As BleepingComputer points out, the malicious Ledger Live app tricked 50 macOS users into giving away their seed and recovery phrases, which let bad actors take their funds in a matter of days.

Basically, if you’re careful about where you download apps from, and—most importantly—NEVER write your private keys on your computer (only on the USB drive), you’ll be safe from these scams.

This isn't enough either, asking to enter your recovery seed or private key isn't the end game to these scams, I fell for one myself and it doesn't work this way, I downloaded the crypto wallet from Google playstore.

Used it for several weeks, I don't even knew that it was fake, I was happy to use because it's working as I expected, so the scammers let me deposit and withdraw with no issue, knowing that I will trust the wallet more.

And that's exactly what went down, after few weeks have passed I stored more money then on a afternoon they wiped the whole balance, I could believe my eye, I cried that day like a baby because that was all I had, I was still new to crypto at that time, I learnt right after that it was a wrong crypto wallet.

[Die_empty]

It’s not enough to just download a fake app. As I saw on another site, the problem is that those apps asked users to enter their private keys on their computers, and some unsuspecting people fell for the scam, as the article linked by the OP also points out:

I'm not sure why people don't take the time to learn about wallet security tips before buying crypto. It would be better not to invest in the crypto industry if you don't have the right knowledge. Some of them are just driven by profit, without learning the basics. I find it hard to believe that somebody will give out their private keys to random people on the internet.

People will be saying that Apple is better than Windows in protecting their users but this let us know that all those talks are just deceitful. If someone is using something that is online, they should be guarded and be expecting something like this to happen. All those operating system providers can not always be protecting their users. We have seen many vulnerabilities in the operating systems and also there have been many malware on their Stores but people are not ready to learn until they learn in the hard way after they have been scammed or after their coins are stolen.

Apple will always say that it intensively scrutinizes every single app submitted to the App Store. This is not the case because there have been incidents of fake or clone apps in the App Store. Until there is a law that gives users the right to hold them responsible for losses suffered because of their lack of scrutiny, they will not step up to securing their store.

[JiiBs]

It started with a fake Ledger Live app on App store for macOS users, between April 8 and April 11, three different victims lost $3.23 million, $2.08 million and $1.95 million. But in total, the thieves were able to take around $9.5 million from over 50 people before Apple deleted the app.

The fake app was able to steal peoples bitcoin, ethereum, tron, solana, ripple and other cryptocurrencies before the fake app was taken down.

There are going to be many of these kind of news even in the future with Bitcoin and Cryptocurrencies on the whole, attaining more mainstream recognition. This isn’t completely due to the lack of information on how to guide against these things but, the ease that comes with just going over to these stores, click on the search function and download the first result that is presented to you or that which looks appealing in design.

Mind you, these scammers are mainly out there for the bug fishes. They let it ride at first, allowing users to use them without much problems, executing their transactions as though it would have being legit wallet but, when they’ve being able to get a lot of users to use this app and they find the amount in holding huge enough for the time the wallet have existed, they collect.

Bitcoin and cryptocurrency investors needs not to be just aware but to take security seriously and go by the information they’ve got, using them as a guide in downloading only from credible and verified sources. It’s of utmost necessity.