← Apple App Store — Systematic Fake Crypto Wallet Cluster (26 Apps, April 2026)reviewed 2026-10-16 · 24 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Apple App Store — Systematic Fake Crypto Wallet Cluster (26 Apps, April 2026) against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
4 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #9[disputed][awaiting moderator]in section: Threat Actor Attribution — SparkKitty
“SparkCat, first uncovered in January 2025, focused on gaining access to cryptocurrency wallets by scanning victims' photo galleries for seed phrase screenshots using OCR.”
reviewerSparkCat was first uncovered/documented in January 2025.The page's own cited source (The Hacker News) and the Kaspersky primary blog post both place SparkCat's public disclosure in February 2025, not January 2025.Proposed correction (not yet applied)SparkCat, first uncovered in February 2025, focused on gaining access to cryptocurrency wallets by scanning victims' photo galleries for seed phrase screenshots using OCR. - #10[disputed][awaiting moderator]in section: Connections to Broader Fraud Network
“SparkCat, documented in January 2025, pioneered OCR-based photo gallery scanning to extract seed phrase screenshots from victim devices; it was active on both the Apple App Store and Google Play and was linked to Chinese-speaking operators.”
reviewerSparkCat was documented in January 2025 and pioneered OCR-based photo-gallery scanning for seed phrases, active on both the App Store and Google Play, linked to Chinese-speaking operators.Same underlying date error as the SparkCat reference in the Threat Actor Attribution section; grouped under the same defect.Proposed correction (not yet applied)SparkCat, documented in February 2025, pioneered OCR-based photo gallery scanning to extract seed phrase screenshots from victim devices; it was active on both the Apple App Store and Google Play and was linked to Chinese-speaking operators. - #11[disputed][awaiting moderator]in the timeline
“2024-06”
reviewerSparkKitty malware was first documented by Kaspersky in June 2024.The timeline date field is off by exactly one year from the page's own correctly-stated prose claim and from the primary source's publish date.Proposed correction (not yet applied)2025-06 - #14[disputed][awaiting moderator]in section: Apple's Response and App Store Review Process Failures
“The fake Ledger Live app on the Mac App Store was removed on or around April 14, 2026, approximately two weeks after it became active.”
reviewerThe fake Ledger Live app was removed on or around April 14, 2026, approximately two weeks after it became active.This sentence contradicts the page's own stated dates (active April 7-13, removed April 14 = about one week) and the earlier section of the same page, which correctly says 'roughly one week.' Internal inconsistency within the page.Proposed correction (not yet applied)The fake Ledger Live app on the Mac App Store was removed on or around April 14, 2026, approximately one week after it became active.
unverifiable
1 claimNo source the reviewer could reach confirms or contradicts the claim.
- #24[unverifiable][awaiting moderator]in section: Campaign Overview and Discovery
“Kaspersky on X — Sergey Puzan video explanation of the attack”
reviewerA Kaspersky tweet/X post by Sergey Puzan contains a video explanation of the FakeWallet attack.Could not independently confirm this specific X post due to platform access restrictions; not treated as link_rot since a 402 from X does not establish the content is gone.
partially supported
2 claimsThe cited evidence supports part of the claim but not all of it.
- #6[partially supported][awaiting moderator]in section: Attack Tactics and Technical Methods
“Some variants also incorporated optical character recognition (OCR) to extract seed phrases captured in screenshots on the device's photo roll — a technique previously documented in the related SparkKitty and SparkCat campaigns.”
reviewerSome FakeWallet variants also used OCR to extract seed phrases from screenshots in the photo roll, a technique from the related SparkKitty/SparkCat campaigns.OCR use in some FakeWallet samples is confirmed by The Hacker News, but the specific 'photo roll screenshot' framing is inferred from the SparkKitty/SparkCat precedent rather than directly stated for FakeWallet itself. - #8[partially supported][awaiting moderator]in section: Threat Actor Attribution — SparkKitty
“The group is assessed with moderate confidence to be operated by Chinese-speaking actors, based on Chinese-language logging messages embedded throughout the malware code, code structure overlaps, and shared infrastructure with the prior SparkCat campaign.”
reviewerKaspersky attributed FakeWallet with moderate confidence to SparkKitty, citing Chinese-language logging messages embedded throughout the malware code as part of the Chinese-speaking-actor assessment.The overall moderate-confidence attribution to Chinese-speaking actors is supported, but the specific 'logging messages embedded throughout the malware code' detail does not appear in any source checked, including the cited primary Kaspersky report; it overstates the specificity of the evidence.
confirmed
17 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: Campaign Overview and Discovery
“Kaspersky researcher Sergey Puzan identified more than 26 malicious iOS applications in the Apple App Store masquerading as legitimate cryptocurrency wallets. The full research report was published on April 20, 2026 via Kaspersky's Securelist blog.”
reviewerKaspersky researcher Sergey Puzan identified more than 26 malicious iOS apps impersonating crypto wallets on the Apple App Store, publicized via Securelist on April 20, 2026.Directly confirmed by fetching the Securelist report. - #2[confirmed][no action needed]in section: Campaign Overview and Discovery
“The 26 apps collectively impersonated seven major wallets: MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken, and Bitpie.”
reviewerThe 26 apps collectively impersonated seven wallets: MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken, and Bitpie.Confirmed via direct fetch of Securelist report. - #3[confirmed][no action needed]in section: Campaign Overview and Discovery
“The apps were first noticed appearing prominently in Chinese App Store search results in March 2026. The campaign was designated FakeWallet and had been active, based on malware metadata, since at least the fall of 2025.”
reviewerThe apps were first noticed in Chinese App Store search results in March 2026, and the campaign had been active since at least fall 2025 based on malware metadata.Confirmed via direct fetch. - #4[confirmed][no action needed]in section: Attack Tactics and Technical Methods
“Attackers used typosquatting (intentionally misspelled wallet names such as 'LeddgerNew') and cloned logos to appear credible in search results.”
reviewerAttackers used typosquatting with a specific misspelled app name 'LeddgerNew' and cloned logos, and the apps redirected victims to fake App-Store-style pages prompting a developer provisioning profile install, exploiting Apple's $299/year Developer Enterprise Program to sideload a trojanized app.The $299/year enterprise program fee is also independently confirmed as Apple's current published rate. - #5[confirmed][no action needed]in section: Attack Tactics and Technical Methods
“For hot wallets, a compromised viewDidLoad method scanned the screen for mnemonic seed phrases, which were then encrypted using RSA/PKCS #1, Base64-encoded, and exfiltrated via HTTP POST to attacker command-and-control servers.”
reviewerA hooked viewDidLoad method scanned the screen for mnemonic seed phrases, which were encrypted with RSA/PKCS#1, Base64-encoded, and exfiltrated via HTTP POST; Ledger-themed cold-wallet variants used injected React Native screens with fake seed-phrase verification windows including mnemonic autocomplete.Core technical chain confirmed by the primary research report; the autocomplete detail is a minor, non-material overstatement of which UI layer supports it. - #7[confirmed][no action needed]in section: Geographic Targeting and Opportunity Exploitation
“Despite this regional focus, the malware itself contained no built-in geographic restrictions, meaning victims from outside China could also have been affected if they accessed the apps. Android versions of some trojanized wallets were additionally distributed through phishing websites, extending the campaign beyond the iOS ecosystem.”
reviewerThe campaign targeted Chinese iOS users almost exclusively by region lock, exploiting the absence of official wallet apps on the Chinese storefront; the malware itself has no geographic restriction, and Android versions were distributed via phishing websites.Confirmed by independent reporting. - #12[confirmed][no action needed]in section: Threat Actor Attribution — SparkKitty
“SparkKitty was first documented by Kaspersky in June 2025 and had been active since at least February 2024.”
reviewerSparkKitty was first documented by Kaspersky in June 2025 and had been active since at least February 2024.Correct in the prose, which makes the contradicting '2024-06' timeline date (see separate finding) clearly an isolated data-entry error rather than a belief held throughout the page. - #13[confirmed][no action needed]in section: Concurrent Incident: Fake Ledger Live on Mac App Store ($9.5M Stolen)
“This app was active between approximately April 7 and April 13, 2026, a window of roughly one week before Apple removed it on or around April 14, 2026.”
reviewerA fraudulent Ledger Live app under developer account 'Leva Heal Limited' was active on the Mac App Store approximately April 7-13, 2026, and was removed around April 14, 2026, roughly one week after becoming active.Confirmed via direct fetch of the cited CoinDesk article. - #15[confirmed][no action needed]in section: Concurrent Incident: Fake Ledger Live on Mac App Store ($9.5M Stolen)
“The three largest individual thefts were $3.23 million in USDT (April 9), $2.08 million in USDC (April 11), and $1.95 million in a mix of BTC, ETH, and stETH (April 8).”
reviewerThe three largest individual thefts in the Ledger Live incident were $3.23M USDT (April 9), $2.08M USDC (April 11), and $1.95M in BTC/ETH/stETH (April 8).Confirmed. - #16[confirmed][no action needed]in section: Concurrent Incident: Fake Ledger Live on Mac App Store ($9.5M Stolen)
“One documented victim, publicly identified only as '@glove,' lost 5.9 BTC representing their entire savings accumulated over a decade. Stolen assets were routed through more than 150 KuCoin deposit addresses and connected to a centralized mixing service identified as 'AudiA6.' KuCoin subsequently froze the implicated accounts until April 20, 2026.”
reviewerA victim publicly identified only as '@glove' lost 5.9 BTC representing a decade of savings; funds were routed through 150+ KuCoin deposit addresses and the AudiA6 mixing service; KuCoin froze the implicated accounts until April 20, 2026.Fully confirmed. Note: other reporting (Decrypt) separately identifies this victim by name as musician 'G. Love' rather than only by handle, but the page's own cited source (CoinDesk) itself refers to the victim only as @glove, so the claim as written accurately reflects its cited source. - #17[confirmed][no action needed]in section: Concurrent Incident: Fake Ledger Live on Mac App Store ($9.5M Stolen)
“Ledger CTO Charles Guillemet publicly stated after the incident that the legitimate Ledger Live application will never request a user's 24-word recovery phrase.”
reviewerLedger CTO Charles Guillemet publicly stated that the legitimate Ledger Live app will never request a user's 24-word recovery phrase.Confirmed via independent search, consistent with Guillemet's other public statements on this topic. - #18[confirmed][no action needed]in section: Concurrent Incident: Fake Sparrow Wallet (Lawsuit Filed July 2026)
“Three plaintiffs — James Ramirez, Christopher Ellis, and Jalen Delgado — filed suit against Apple in the Northern District of California in late July 2026, alleging collective losses of approximately $1.84 million.”
reviewerThree plaintiffs (Ramirez, Ellis, Delgado) sued Apple in the Northern District of California in late July 2026 over a fake Sparrow Wallet iOS app, alleging combined losses of approximately $1.84 million; Ramirez downloaded it July 25, 2025 (losing 7.4 BTC), Ellis on August 3, 2025 (losing ~$840,000), and Delgado around May 1, 2025 (losing 1.05 BTC).All individual-plaintiff details independently confirmed. - #19[confirmed][no action needed]in section: Concurrent Incident: Fake Sparrow Wallet (Lawsuit Filed July 2026)
“The complaint further notes that legitimate Sparrow Wallet developer Craig Raw had first warned Apple about unauthorized mobile impersonators as early as January 2024, and that when Raw attempted to submit a placeholder iOS listing to warn users, Apple threatened to terminate his developer account for alleged 'dishonest activity' — before reversing that decision in June 2026.”
reviewerCraig Raw first warned Apple about unauthorized mobile impersonators as early as January 2024, and when he tried to submit a placeholder iOS listing, Apple threatened to terminate his developer account for alleged 'dishonest activity' before reversing that decision in June 2026.Confirmed through independent sources, including details not found in the page's own cited CryptoSlate article. - #20[confirmed][no action needed]in section: Concurrent Incident: Fake Wasabi Wallet
“A fraudulent Wasabi Wallet application also appeared on the Apple App Store in 2026, with at least one confirmed victim reporting a loss of approximately 6 BTC. The app was identified as part of an expanding count of fake wallet listings on Apple's platform — collectively, at least 27 distinct wallet clone listings were identified on the App Store during 2026.”
reviewerA fraudulent Wasabi Wallet app caused at least one confirmed loss of approximately 6 BTC, part of at least 27 distinct wallet clone listings identified on the App Store during 2026.Confirmed. - #21[confirmed][no action needed]in section: Apple's Response and App Store Review Process Failures
“Apple's public defense of its marketplace states that its review process prevented more than $9 billion in fraudulent transactions between 2020 and 2024, and that nearly 2 million app submissions are rejected annually.”
reviewerApple's public defense states its review process prevented more than $9 billion in fraudulent transactions between 2020 and 2024, and nearly 2 million app submissions are rejected annually.Confirmed. - #22[confirmed][no action needed]in section: Apple's Response and App Store Review Process Failures
“The repeated pattern of fraudulent wallet apps bypassing review — spanning at least Sparrow Wallet (2024-2025), Trezor wallet (2023), Rabby Wallet (2024), MyEtherWallet (2017), the FakeWallet cluster (2025-2026), and the Ledger Live and Wasabi Wallet incidents (2026) — has prompted legal scrutiny of Apple's review processes.”
reviewerThe repeated pattern of fraudulent wallet apps bypassing review spans Sparrow Wallet, Trezor (2023), Rabby Wallet (2024), MyEtherWallet (2017), the FakeWallet cluster, and the Ledger Live/Wasabi incidents.All historical incidents independently verified via web search, though the cited source itself does not contain these details — a citation-matching gap rather than a factual error. - #23[confirmed][no action needed]in section: Victim Impact and Documented Losses
“Combined confirmed losses from the discrete, verifiable incidents on Apple's platforms in 2026 therefore exceed $11 million, excluding the FakeWallet cluster for which victim financials have not been independently quantified.”
reviewerCombined confirmed losses from the discrete, verifiable 2026 incidents on Apple's platforms exceed $11 million, excluding the FakeWallet cluster whose victim financials have not been independently quantified.Confirmed as an accurate sum of previously verified figures; the page is appropriately transparent that the FakeWallet cluster total is unquantified.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.