Skip to main content
AVOID.NET

Apple App Store — Systematic Fake Crypto Wallet Cluster (26 Apps, April 2026)

avoid.net/apple-app-store-systematic-fake-crypto-wallet-cluster-26-apps-april-2026→0/100·87% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·3T9wXt…r4mt

Summary

Beginning in at least fall 2025 and publicly disclosed in April 2026, a coordinated cluster of 26 fraudulent iOS applications impersonating major cryptocurrency wallets was discovered on Apple's App Store by Kaspersky researchers. The campaign, dubbed FakeWallet and attributed with moderate confidence to the SparkKitty threat actor group, targeted seed phrase theft primarily from Chinese iOS users. The broader pattern of fake wallet apps on Apple's platforms in 2026 resulted in documented losses exceeding $11 million across multiple distinct incidents and triggered civil litigation against Apple.

Connected Entities

15 entities · 60 linked investigations
Organizations
□Ethereum64□Fake Sparrow Wallet (Apple App Store)□AudiA6□Trust Wallet□Leva Heal Limited (Fake Ledger Live App - Apple App Store)□fake Ledger Live app□Trezor□Ledger Live□Solana□ZachXBT□Apple App Store — Systematic Fake Crypto Wallet Cluster (26 Apps, April 2026)□AudiA6 Mixing Service
Tokens
♦Coinbase♦KuCoin♦Bitcoin
Relationships
  • Apple App Store — Systematic Fake Crypto Wallet Cluster (26 Apps, April 2026)→mentioned with→Ethereum(60%)
  • Ethereum→mentioned with→Coinbase(60%)
  • Ledger Live→mentioned with→Ethereum(65%)
  • Ethereum→mentioned with→Bitcoin(60%)
  • Ledger Live→mentioned with→KuCoin(70%)
  • Ledger Live→mentioned with→AudiA6(60%)
  • Apple App Store — Systematic Fake Crypto Wallet Cluster (26 Apps, April 2026)→mentioned with→Coinbase(70%)
  • Ledger Live→mentioned with→Bitcoin(70%)
  • Ledger Live→mentioned with→Solana(60%)
  • Apple App Store — Systematic Fake Crypto Wallet Cluster (26 Apps, April 2026)→mentioned with→AudiA6(70%)
  • + 67 more
Have evidence about Apple App Store — Systematic Fake Crypto Wallet Cluster (26 Apps, April 2026)?

Timeline(21 events)

2017

Fake MyEtherWallet app appeared on Apple App Store — among the earliest documented fake crypto wallet incidents on the platform.

9to5Mac / Crypto Briefing (historical reference)

2023

Fake Trezor wallet app appeared on Apple App Store, establishing a recurring pattern of impersonation campaigns.

9to5Mac / Crypto Briefing (historical reference)

2024

Craig Raw, developer of Sparrow Wallet, first warned Apple about fake iOS Sparrow Wallet apps. Apple failed to remove them promptly. Fake Rabby Wallet also appeared during this period.

CryptoSlate

June 2024

SparkKitty malware first documented by Kaspersky, linked to Chinese-speaking operators. Campaign assessed to have begun as early as February 2024.

Securelist — The new SparkKitty Trojan spy in the App Store and Google Play

2025

SparkCat spyware campaign publicly uncovered; used OCR to scan iOS and Android photo galleries for crypto wallet seed phrase screenshots.

The Hacker News

May 2025

Jalen Delgado downloaded fake Sparrow Wallet iOS app, losing 1.05 BTC (approximately $120,000).

9to5Mac

25 July 2025

James Ramirez downloaded fake Sparrow Wallet iOS app, losing 7.4 BTC worth approximately $875,000. Ramirez reported the theft to Apple.

9to5Mac / CoinDesk

3 August 2025

Christopher Ellis downloaded fake Sparrow Wallet iOS app more than a week after Ramirez's theft report, losing approximately $840,000. Apple had not removed the app or responded to Ramirez.

9to5Mac / CoinDesk

September 2025

FakeWallet campaign assessed to have begun operating on the Apple App Store, based on malware metadata reviewed by Kaspersky.

Kaspersky Press Release

March 2026

26 FakeWallet cluster apps first noticed appearing prominently in Chinese App Store search results by Kaspersky researchers.

Securelist / The Hacker News

7 April 2026

Fake Ledger Live app (developer: Leva Heal Limited) on Mac App Store begins active theft campaign. First major victim losses recorded.

CoinDesk / AppleInsider

8 April 2026

Largest single-day losses in Ledger Live incident: one victim loses $1.95 million in BTC, ETH, and stETH.

CoinDesk / AppleInsider

9 April 2026

Second-largest theft in Ledger Live incident: one victim loses $3.23 million in USDT.

CoinDesk / AppleInsider

11 April 2026

Third-largest theft in Ledger Live incident: one victim loses $2.08 million in USDC.

CoinDesk / AppleInsider

13 April 2026

Fake Ledger Live theft campaign ends. ZachXBT begins tracing stolen funds through 150+ KuCoin deposit addresses and AudiA6 mixing service.

CoinDesk

14 April 2026

Apple removes fake Ledger Live app from the Mac App Store. Total losses confirmed at approximately $9.5 million from 50+ victims.

MacRumors / AppleInsider

20 April 2026

Kaspersky publishes full FakeWallet research report by Sergey Puzan on Securelist. All 26 iOS FakeWallet apps reported to Apple. Attribution to SparkKitty stated with moderate confidence.

Securelist / Kaspersky Press Release

20 April 2026

KuCoin freezes deposit accounts implicated in laundering of stolen Ledger Live funds.

AppleInsider / CyberInsider

June 2026

Apple reverses threatened termination of Sparrow Wallet developer Craig Raw's account, restoring his ability to submit an iOS warning placeholder.

CryptoSlate

24 July 2026

Three Sparrow Wallet victims file lawsuit against Apple in the Northern District of California, seeking restitution for $1.84 million in combined Bitcoin losses.

MacRumors / CoinDesk / 9to5Mac

28 July 2026

CoinDesk reports details of the Sparrow Wallet lawsuit, including allegation that Apple failed to act for over a week after the first $875,000 theft was reported.

CoinDesk
Provenance & Audit Trail

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (3 events). 25 of 25 cited source URLs have an Internet Archive snapshot.

model: claude-sonnet-4-6

generated: 8/10/2026, 11:32:19 PM

last updated: 8/25/2026, 7:21:29 PM

4 views

avoid.net — verified advice for a post-truth world