Apple App Store — Systematic Fake Crypto Wallet Cluster (26 Apps, April 2026)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·3T9wXt…r4mtSummary
Beginning in at least fall 2025 and publicly disclosed in April 2026, a coordinated cluster of 26 fraudulent iOS applications impersonating major cryptocurrency wallets was discovered on Apple's App Store by Kaspersky researchers. The campaign, dubbed FakeWallet and attributed with moderate confidence to the SparkKitty threat actor group, targeted seed phrase theft primarily from Chinese iOS users. The broader pattern of fake wallet apps on Apple's platforms in 2026 resulted in documented losses exceeding $11 million across multiple distinct incidents and triggered civil litigation against Apple.
Connected Entities
15 entities · 60 linked investigations- Apple App Store — Systematic Fake Crypto Wallet Cluster (26 Apps, April 2026)→mentioned with→Ethereum(60%)
- Ethereum→mentioned with→Coinbase(60%)
- Ledger Live→mentioned with→Ethereum(65%)
- Ethereum→mentioned with→Bitcoin(60%)
- Ledger Live→mentioned with→KuCoin(70%)
- Ledger Live→mentioned with→AudiA6(60%)
- Apple App Store — Systematic Fake Crypto Wallet Cluster (26 Apps, April 2026)→mentioned with→Coinbase(70%)
- Ledger Live→mentioned with→Bitcoin(70%)
- Ledger Live→mentioned with→Solana(60%)
- Apple App Store — Systematic Fake Crypto Wallet Cluster (26 Apps, April 2026)→mentioned with→AudiA6(70%)
- + 67 more
Timeline(21 events)
2017
Fake MyEtherWallet app appeared on Apple App Store — among the earliest documented fake crypto wallet incidents on the platform.
9to5Mac / Crypto Briefing (historical reference)2023
Fake Trezor wallet app appeared on Apple App Store, establishing a recurring pattern of impersonation campaigns.
9to5Mac / Crypto Briefing (historical reference)2024
Craig Raw, developer of Sparrow Wallet, first warned Apple about fake iOS Sparrow Wallet apps. Apple failed to remove them promptly. Fake Rabby Wallet also appeared during this period.
CryptoSlateJune 2024
SparkKitty malware first documented by Kaspersky, linked to Chinese-speaking operators. Campaign assessed to have begun as early as February 2024.
Securelist — The new SparkKitty Trojan spy in the App Store and Google Play2025
SparkCat spyware campaign publicly uncovered; used OCR to scan iOS and Android photo galleries for crypto wallet seed phrase screenshots.
The Hacker NewsMay 2025
Jalen Delgado downloaded fake Sparrow Wallet iOS app, losing 1.05 BTC (approximately $120,000).
9to5Mac25 July 2025
James Ramirez downloaded fake Sparrow Wallet iOS app, losing 7.4 BTC worth approximately $875,000. Ramirez reported the theft to Apple.
9to5Mac / CoinDesk3 August 2025
Christopher Ellis downloaded fake Sparrow Wallet iOS app more than a week after Ramirez's theft report, losing approximately $840,000. Apple had not removed the app or responded to Ramirez.
9to5Mac / CoinDeskSeptember 2025
FakeWallet campaign assessed to have begun operating on the Apple App Store, based on malware metadata reviewed by Kaspersky.
Kaspersky Press ReleaseMarch 2026
26 FakeWallet cluster apps first noticed appearing prominently in Chinese App Store search results by Kaspersky researchers.
Securelist / The Hacker News7 April 2026
Fake Ledger Live app (developer: Leva Heal Limited) on Mac App Store begins active theft campaign. First major victim losses recorded.
CoinDesk / AppleInsider8 April 2026
Largest single-day losses in Ledger Live incident: one victim loses $1.95 million in BTC, ETH, and stETH.
CoinDesk / AppleInsider9 April 2026
Second-largest theft in Ledger Live incident: one victim loses $3.23 million in USDT.
CoinDesk / AppleInsider11 April 2026
Third-largest theft in Ledger Live incident: one victim loses $2.08 million in USDC.
CoinDesk / AppleInsider13 April 2026
Fake Ledger Live theft campaign ends. ZachXBT begins tracing stolen funds through 150+ KuCoin deposit addresses and AudiA6 mixing service.
CoinDesk14 April 2026
Apple removes fake Ledger Live app from the Mac App Store. Total losses confirmed at approximately $9.5 million from 50+ victims.
MacRumors / AppleInsider20 April 2026
Kaspersky publishes full FakeWallet research report by Sergey Puzan on Securelist. All 26 iOS FakeWallet apps reported to Apple. Attribution to SparkKitty stated with moderate confidence.
Securelist / Kaspersky Press Release20 April 2026
KuCoin freezes deposit accounts implicated in laundering of stolen Ledger Live funds.
AppleInsider / CyberInsiderJune 2026
Apple reverses threatened termination of Sparrow Wallet developer Craig Raw's account, restoring his ability to submit an iOS warning placeholder.
CryptoSlate24 July 2026
Three Sparrow Wallet victims file lawsuit against Apple in the Northern District of California, seeking restitution for $1.84 million in combined Bitcoin losses.
MacRumors / CoinDesk / 9to5Mac28 July 2026
CoinDesk reports details of the Sparrow Wallet lawsuit, including allegation that Apple failed to act for over a week after the first $875,000 theft was reported.
CoinDeskDecision Log
- hash: 62hEn6oZfDRGaUXtoHfLM1Jpo5pgHhZfpePiKmFQhybu
- hash: CedgESR9YYnUYv63vxVkMyia7tn8twXxsfLadrmHsix5
- hash: 9RzyygTB72pH9m5zegBqdnsrjR8tea6PWeQhPQcTy2iE
This investigation is cryptographically anchored to the Solana blockchain (3 events). 25 of 25 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/10/2026, 11:32:19 PM
last updated: 8/25/2026, 7:21:29 PM
4 viewsavoid.net — verified advice for a post-truth world