Skip to main content
AVOID.NET
Sign in

Leva Heal Limited (Fake Ledger Live App - Apple App Store)

avoid.net/leva-heal-limited-fake-ledger-live-app-apple-app-store→2/100·88% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·MWerCR…eJJT

Summary

Leva Heal Limited is a UK-registered company (Companies House number 12178110) whose Apple developer account was used to publish a fraudulent application impersonating Ledger Live on the macOS App Store between April 7 and April 13, 2026. The app harvested users' 24-word seed phrases, resulting in the theft of approximately $9.5 million in cryptocurrency from at least 50 victims. Apple removed the app and terminated the associated developer account on or around April 13-14, 2026, after community reports surfaced through on-chain investigator ZachXBT.

Connected Entities

10 entities · 60 linked investigations
Organizations
□Ethereum64□AudiA6□Leva Heal Limited (Fake Ledger Live App - Apple App Store)□fake Ledger Live app□Ledger Live□Solana□ZachXBT□AudiA6 Mixing Service
Tokens
♦KuCoin♦Bitcoin
Relationships
  • Ledger Live→mentioned with→Ethereum(65%)
  • Ethereum→mentioned with→Bitcoin(60%)
  • Ledger Live→mentioned with→KuCoin(70%)
  • Ledger Live→mentioned with→AudiA6(60%)
  • Ledger Live→mentioned with→Bitcoin(70%)
  • Ledger Live→mentioned with→Solana(60%)
  • Ledger Live→mentioned with→ZachXBT(65%)
  • KuCoin→mentioned with→Bitcoin(70%)
  • KuCoin→mentioned with→ZachXBT(70%)
  • KuCoin→mentioned with→AudiA6(60%)
  • + 33 more
Also appears in
Ethereum·64Lendf.me·30Levyathan·18Jump Trading·42StableMagnet·2Shibarium·28Bankr·18Nexera·32Sky (MakerDAO)·51BearnFi·12

Connected Through

9 shared actors · 616 investigations

Distinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.

Have evidence about Leva Heal Limited (Fake Ledger Live App - Apple App Store)?

Timeline(11 events)

28 August 2019

Leva Heal Limited incorporated in England and Wales under the name Khiron Life Sciences UK Limited (Companies House number 12178110).

Companies House (GOV.UK)

10 September 2024

Company renamed from Khiron Life Sciences UK Limited to Leva Heal Limited.

Companies House (GOV.UK)

2025

Michael Anthony Steele (Canadian national) becomes person with significant control (75%+ shares and voting rights) of Leva Heal Limited.

Companies House (GOV.UK)

7 April 2026

Fraudulent 'Ledger Live' app published on Apple macOS App Store under developer name 'Leva Heal Limited'; first victim fund thefts begin.

BleepingComputer / CoinDesk / The Block

8 April 2026

First documented large theft: approximately $1.95 million in Bitcoin, ETH, and staked ETH stolen from a single victim.

CoinDesk / HackRead

9 April 2026

Second large documented theft: approximately $3.23 million in USDT stolen from a single victim.

CoinDesk / CoinTelegraph

11 April 2026

Third large documented theft: approximately $2.08 million in USDC stolen from a single victim. Musician G. Love (Garrett Dutton) also loses 5.92 BTC (approximately $420,000-$447,000) after entering his seed phrase into the fake app.

Decrypt / Bitcoin.com News / CoinDesk

13 April 2026

App removed from Apple App Store. Apple terminates the associated developer account.

9to5Mac / MacRumors / AppleInsider

14 April 2026

ZachXBT publishes public investigation report linking fake Ledger Live app to $9.5 million theft from 50+ victims; major media coverage begins. CoinDesk, AppleInsider, The Block report on the incident.

The Block / CoinDesk / AppleInsider

15 April 2026

Ledger CTO Charles Guillemet issues public statement warning users that the real Ledger Live 'will never ask for your 24 words.'

CoinTelegraph / BleepingComputer

20 April 2026

Alleged KuCoin account freeze deadline cited in connection with stolen funds held at KuCoin deposit addresses; no confirmed fund recovery reported.

AppleInsider
Provenance & Audit Trail
Anchored on SolanaVerify on-chain19 Wayback Archives

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (1 event). 19 of 20 cited source URLs have an Internet Archive snapshot.

full audit log →version history →

model: claude-sonnet-4-6

generated: 6/30/2026, 11:06:26 PM

last updated: 7/28/2026, 6:38:22 AM

3 views

avoid.net — verified advice for a post-truth world