Apple Sued After Fake iPhone Wallet App Drained $1.8M in Bitcoin

[_act_]

I do not know if we have discussed about this before, but I could remember similar incident which is not about lawsuit but about how some iPhone users downloaded fake Sparrow on App store and this could be part of the people that were affected at the time. Also Apple generally has been susceptible to vulnerabilities which affect users that do not avoid malware. But this is not about avoiding malware, it about downloading fake wallet on the App store.

Three bitcoin holders have sued Apple in California federal court, saying a counterfeit Sparrow Wallet app took a combined $1.8 million. One plaintiff reported the app to Apple; another downloaded it nine days later and lost $840,000, the complaint says.

https://decrypt.co/374628/apple-sued-after-fake-iphone-wallet-app-drained-1-8m-in-bitcoin

This is an avoidable mistake, but I think Apple and Google need to take the responsibility of their users not to download fake apps on their stores. There are many bitcoin users that do not even know what verifying of wallet signature is before using a wallet. But if they do not know that, they should know that they should make investigation before making use of a wallet. If Sparrow is now on App store, it would be seen online through search and also seen on their office website.

Sparrow bitcoin wallet official website: https://sparrowwallet.com/
https://sparrowwallet.com/download/

[Upgrade00]

Security checks and verifications done by Google and. Apple is very poor. You can get really low ranking pages getting indexed when you search for a topic and fake apps getting in and staying there even after reports.

I also believe that if you are purchasing that value of crypto into the wallet you should be doing your extensive research before using any one, thiswill teach you how to download from the official source and verify signatures. There are also some other simpler ways, although not foolproof that can help you detect such apps. Also test with a small amount first and wait for sometime before you send the full portfolio.

[_act_]

Security checks and verifications done by Google and. Apple is very poor. You can get really low ranking pages getting indexed when you search for a topic and fake apps getting in and staying there even after reports.

Very poor, people should not depend on them. I know this will not be the last because of how poor they are.

There are also some other simpler ways, although not foolproof that can help you detect such apps. Also test with a small amount first and wait for sometime before you send the full portfolio.

I will not test it with any money. I can not even download it at all. Going through the Sparrow download on the website which is the link I posted last will let me easily know that it is a fake app if I do not find it there. I downloaded Sparrow only from the official website.

The website can be compromised, which is the reason to verify the wallet signature is very important, but it has not gotten to this stage before knowing it is a fake wallet.

[suhadi88]

Yes, that's right. I saw it reported in several online media outlets in our area, and it quickly spread. You have to be careful, because at first glance, I read that the original Sparrow Wallet is a desktop Bitcoin wallet (for computers). Many app versions are questionable or disguised as Sparrow Wallet. It's a shame for the victims who suffer losses by downloading directly without verifying their official address. Sadly, most people assume that once it's in the App Store, it's more or less safe. It turns out that's not always true.

[Rikafip]

Three bitcoin holders have sued Apple in California federal court, saying a counterfeit Sparrow Wallet app took a combined $1.8 million. One plaintiff reported the app to Apple; another downloaded it nine days later and lost $840,000, the complaint says.

The thing that baffles me here is that someone actually used mobile phone wallet to store such a big amount of money. I mean, I personally don't store more than few hundreds of dollars worth of crypto on my hot wallet, and here we have people running around with almost million of dollars in their pocket.

Tbh, this was just accident waiting to happen, and if they didn't lose money on this fake wallet, sooner or later they would lose it in some other way.

[PostQuantumBTC]

The thing that baffles me here is that someone actually used mobile phone wallet to store such a big amount of money. I mean, I personally don't store more than few hundreds of dollars worth of crypto on my hot wallet, and here we have people running around with almost million of dollars in their pocket.

Tbh, this was just accident waiting to happen, and if they didn't lose money on this fake wallet, sooner or later they would lose it in some other way.

I do not think a hardware wallet can safe someone like them either, there were few fake Ledger and Trezor apps on Apple store which some people used to lose their money too. I am not really sure of Trezor Suite but I am sure of the Ledger app. They can also use it and lost their bitcoin. Anyone that want to invest in bitcoin need to learn how they will avoid all these. You are right, they can buy a hardware wallet with less than $100 or they can do an offline device that will cost not more than a $100.

[Alpha Marine]

It can't be said enough that certain apps should be downloaded directly through the official websites. If you go to the website and follow the App Store or Play Store link, you will download the authentic app. I can't say it is 100% safe, but I have never heard of a story of a person who downloaded a fake app even after going through the official website.
The vulnerability with this comes when you go through a fake website, and there are many out there.

Apple should be held responsible for the losses. They allowed a fake website on their store. They have to pay back what the victims lost. They should e sophiticated enough to not allow fake websites on their stores, no matter how sophisticated the attackers' software might be. They always need to stay ahead.

[bitmover]

This is an avoidable mistake, but I think Apple and Google need to take the responsibility of their users not to download fake apps on their stores. There are many bitcoin users that do not even know what verifying of wallet signature is before using a wallet. But if they do not know that, they should know that they should make investigation before making use of a wallet. If Sparrow is now on App store, it would be seen online through search and also seen on their office website.

Sparrow bitcoin wallet official website: https://sparrowwallet.com/
https://sparrowwallet.com/download/

I don't know much about the subject, but I think  Apple has more responsibility of what goes inside their store than google.

Apple charges a fee for the money developers make  in the app listed. So they have some responsibility of what goes in there.

I am always impressed by the amount of people that put millions of dollars in a mobile wallet 

[BABY SHOES]

Security checks and verifications done by Google and. Apple is very poor. You can get really low ranking pages getting indexed when you search for a topic and fake apps getting in and staying there even after reports.

Apple verification is now very bad after this case, I also saw News where Apple has removed fake applications in its AppStore, meaning they wait for events first and then take action... things like this are bad manners in their security.

The thing that baffles me here is that someone actually used mobile phone wallet to store such a big amount of money. I mean, I personally don't store more than few hundreds of dollars worth of crypto on my hot wallet, and here we have people running around with almost million of dollars in their pocket.

Is it possible that someone wants to use a mobile phone to be more practical? But his ill-fated fate instead downloaded a fake wallet that ended up losing millions of dollars.

Apple is already pretty sure wrong because it is not strict.
The guy was also wrong because he didn't refer to Sparrow's official website first, but instead he directly searched for it in the Appstore.

[ImGenius]

~~~

I used to think that Apple store's apps were at least authentic since it was apple's personal app store. They made a duplicate of something like Sparrow Wallet which is renowned Bitcoin wallet and released it in the apple store, It makes me wonder are they using our trust as business model how can they allow a fake wallet in their store?

I am always impressed by the amount of people that put millions of dollars in a mobile wallet  😀

Maybe they trust Apple’s security so highly that they’re not even afraid to put millions into an online device.

[promise444c5]

Not the first,wont be last either..
I remember Pmalek created  a thread about similar Fake sparrow wallet that stole BTC from a long term holder :https://bitcointalk.org/index.php?topic=5552731.0 . I think he also lauched a campaign that took down a fake sparrow wallet.. it's back again

I don't understand why someone with so much money just decide to download a wallet with zero research on a mobile wallet.. A quick search will even tell them Sparrow has no mobile wallet .

They can go ahead, give it a try but once again, there's high chance they get away with it as usual..

Some people don't  learn easily..

[Cookdata]

Yes, that's right. I saw it reported in several online media outlets in our area, and it quickly spread. You have to be careful, because at first glance, I read that the original Sparrow Wallet is a desktop Bitcoin wallet (for computers). Many app versions are questionable or disguised as Sparrow Wallet. It's a shame for the victims who suffer losses by downloading directly without verifying their official address. Sadly, most people assume that once it's in the App Store, it's more or less safe. It turns out that's not always true.

I'm supporting the fact that they are getting shued. The lowest listing fee of app on app store is $40 payment on phone, pc are more expensive, this is done annualy unlike play store where you do just one time payment. If they collect this kind of money, they should be able to tell to e differences. They let another person to upload fake app which is not related to the original app. I'm sure if they are been dragged now and pay for some damages now, they are going to increase verification system.

Have you even thought about the audacity for a company to allow a fake apps to be uploaded. This company's has different tech expert with good salaries. This kind of things are not supposed to happen but either negligence let them but at the same time this could be that they have not been checking apps that are uploaded on App store until a map get a massive reports about them which they delist after a while.

[Ambatman]

This is an avoidable mistake, but I think Apple and Google need to take the responsibility of their users not to download fake apps on their stores.

Apple considers App Store the only trusted source and are not quick to remove malicious apps
To be sincere with their review process and sandbox I really thought they were better than this.

I do not think a hardware wallet can safe someone like them either, there were few fake Ledger and Trezor apps on Apple store which some people used to lose their money too. I am not really sure of Trezor Suite but I am sure of the Ledger app.

I'm not sure what you mean but hardware wallet are not downloaded they are physical
Trezor or ledger wallet seen on AppStore are hotwallet not hardware.

[PostQuantumBTC]

I do not think a hardware wallet can safe someone like them either, there were few fake Ledger and Trezor apps on Apple store which some people used to lose their money too. I am not really sure of Trezor Suite but I am sure of the Ledger app.

I'm not sure what you mean but hardware wallet are not downloaded they are physical
Trezor or ledger wallet seen on AppStore are hotwallet not hardware.

I know what I posted and it is correct. Ledger has official app called Ledger Live. Trezor has official app called Trezor Suite. The hackers will put a fake Ledger app (fake Ledger Live) or fake Trezor app (fake Trezor Suite) on the Apple store, anyone that download it will probably lost his coins. The app will request for seed phrase of the person which the hacker will use to know the seed phrase and steal the coin of the person.

[Patikno]

I do not know if we have discussed about this before, but I could remember similar incident which is not about lawsuit...

As far as I know, we haven't discussed a lawsuit regarding this case, but a similar discussion has been had, here : Re: A phishing scam discussion ( similar case, but about a different app that is in the Appstore )

I also ever discussed it with some forum friends in local discussions, here : Aplikasi Ledger Live Palsu ada di AppStore, Kerugian $9,5juta+ - the OP @taufik123 ( Indonesian board )

According to me, apple users (or ios users) are right to file lawsuits against fake applications in their official store. Because, the company should be held responsible for their errors, or negligence. Moreover, the App Store made the application a recommendation; based on what I read in the source that the OP attached. Sometimes, I wonder why the authorities don't restrict the apps they provide with very limited, instead of simply letting dangerous apps pass.

By the way, Apple also conducts reviews before an application is released, so I think they are responsible for the fake applications they let through.

Source : Apple.com - App Review Guidelines

[moneystery]

These people undoubtedly thought the apps they downloaded from the App Store were safe, given their high level of security. However, the repeated occurrence of fake wallet apps in the App Store indicates that the platform, which claims to be secure, is not actually immune to malicious applications, and scammers can still trick them.
These individuals are right to sue Apple for these losses, as their negligence in filtering apps entering their App Store has caused significant losses.

[CryptSafe]

I would not blame them for their mistakes of not verifying before downloading as they felt comfortable with the app store believing whatever is there has undergone security check but unbeknownst to them, the security features of the app store is very poor making it very porous for fake apps to be uploaded there.

The trust placed on google and app store to be free of fake and scam made them felt relaxed but it is unfortunate that they learnt the hard way not to trust any online resources but to take time in conducting their research and due diligence before taking any step.  Google and App store should step up their security check measures to making sure their platform is void of fake apps uploaded by hackers.

[goldkingcoiner]

App developers need to be held to higher standards and only then will these corporations actually care about doing anything about the security of their users. Apple does not care about their users as long as there is no change in the profit margins... So I doubt they care about the lawsuit.

Giant corporations need to be regulated differently because they have too much power and the penalties for the actions do not outweigh the profits of those actions. Which is really the main problem.

[PrivacyG]

Apple used to be 'the choice' for people who were too lazy to verify and instead resorted to trusting them.  I would say it was always first of all the mistake of the user for not verifying before actually downloading a piece of Software, particularly considering there are many situations someone can find them selves in where they download an illegitimate Software.  See all the situations where a Twitter account was hacked and advertised a scam temporarily.

On one hand.  Good for them, Apple makes enough bags of money that this case will mean pretty much nothing to them if they eventually end up losing.  But on the other hand.  I wish people trusted less and verified more.  It would be such a great thing to see.

[AVE5]

Also Apple generally has been susceptible to vulnerabilities which affect users that do not avoid malware. But this is not about avoiding malware, it about downloading fake wallet on the App store.

Whether the vulnerability of the device as a result of the user's loosing their bitcoins came as a result of projected malwares or downloading fake files, they're all malwares modified to cause weakness and comprises the security of the Apple device, some may also just steal the necessary informations with all efforts on how to steal the user's fund's.
Due to the strong privacy configurations and the ios operating system of the Apple, it has been that due to the security layers of the device, many user's of the forum had also tend to recommend the Apple device as reliable hardware to store bitcoin.