Verify a decision

{"actor":"system:backfill","investigation_id":"665d9e6c-2f85-4250-9a05-7286e378de06","kind":"publish","page_slug":"leva-heal-limited-fake-ledger-live-app-apple-app-store","published_at":"2026-06-30T23:06:37.685Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Leva Heal Limited (Fake Ledger Live App - Apple App Store)","sections":[{"content":"Leva Heal Limited is incorporated in England and Wales under Companies House registration number 12178110, originally incorporated on 28 August 2019 under the name Khiron Life Sciences UK Limited. The company changed its name to Leva Heal Limited on 10 September 2024. Its registered address is 5 Pemberton Row, London, England, EC4A 3BA. Its stated SIC codes are 32990 (Other manufacturing not elsewhere classified) and 86220 (Specialists medical practice activities), with no stated connection to software development or cryptocurrency services. The sole current director is Michael Anthony Steele (Canadian national, resident in Canada), appointed 21 August 2024. Steele holds over 75% of shares and voting rights as of 1 January 2025. Previous corporate controllers include Heal Europe Holdings Ltd (ceased 29 July 2024) and Khiron Life Sciences Corp. (ceased 28 August 2020). The company's Apple developer account identity — whether the account was legitimately registered to this entity or was created using a stolen or fraudulently registered company identity — had not been publicly confirmed as of the time of reporting. There is no public indication that the company's legitimate principals (Steele or prior directors) were aware of or involved in the fraudulent Apple app submission.","heading":"Identity and Corporate Registration","severity":"critical","sources":[{"credibility":1,"name":"LEVA HEAL LIMITED overview - Companies House (GOV.UK)","type":"official","url":"https://find-and-update.company-information.service.gov.uk/company/12178110"},{"credibility":1,"name":"LEVA HEAL LIMITED persons with significant control - Companies House (GOV.UK)","type":"official","url":"https://find-and-update.company-information.service.gov.uk/company/12178110/persons-with-significant-control"},{"credibility":1,"name":"LEVA HEAL LIMITED officers - Companies House (GOV.UK)","type":"official","url":"https://find-and-update.company-information.service.gov.uk/company/12178110/officers"}]},{"content":"A fraudulent macOS application titled 'Ledger Live' was listed on the Apple App Store under the publisher name 'Leva Heal Limited.' The app replicated the visual design and branding of the legitimate Ledger Live application — official companion software for Ledger hardware wallets — published by Ledger SAS, a French company. The real Ledger Live is not distributed through the macOS App Store; Ledger distributes it exclusively through its own website (ledger.com). The fake app reportedly employed a version-inflation technique, cycling through several major version numbers (allegedly from 1.0 to 5.0) within its two-week lifespan, a tactic sometimes used to create an appearance of legitimacy and longevity during app review. Upon installation, the app presented a wallet setup or sync screen and requested users enter their 24-word BIP39 seed phrase (secret recovery phrase). Submission of the seed phrase gave the attackers immediate, complete control over all wallets derived from that seed. Stolen assets were drained within minutes of entry. It is not known how the fraudulent application passed Apple's app review process; Apple's review team did not flag the mismatch between the publisher entity and the well-known Ledger brand. Apple removed the application and terminated the associated developer account after community reports and media coverage surfaced, not through its own proactive detection.","heading":"The Fraudulent Application: Mechanism and Distribution","severity":"critical","sources":[{"credibility":2,"name":"Fake Ledger Live app on Apple's App Store stole $9.5M in crypto - BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto/"},{"credibility":2,"name":"Apple pulls fake Ledger app and Freecash in rough day for App Store review - 9to5Mac","type":"news_article","url":"https://9to5mac.com/2026/04/14/apple-pulls-fake-ledger-app-and-freecash-in-rough-day-for-app-store-review/"},{"credibility":1,"name":"A fake Ledger app on the Apple App Store drained $9.5 million in crypto - CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/04/14/a-fake-ledger-app-on-the-apple-app-store-just-drained-usd9-5-million-in-crypto"},{"credibility":2,"name":"Fake Ledger app on Apple App Store linked to $9.5M crypto theft across Bitcoin, Tron, Solana: ZachXBT - The Block","type":"news_article","url":"https://www.theblock.co/post/397388/fake-ledger-app-apple-app-store-crypto-theft-bitcoin-tron-solana-zachxbt"},{"credibility":2,"name":"Fake Ledger app on the Apple App Store steals $9.5 million from 50 users - CyberInsider","type":"news_article","url":"https://cyberinsider.com/fake-ledger-app-on-the-apple-app-store-steals-9-5-million-from-50-users/"}]},{"content":"On-chain investigator ZachXBT identified at least 50 victims who lost a combined approximately $9.5 million in cryptocurrency during the app's operational window of April 7-13, 2026. The three largest documented individual losses were: approximately $3.23 million in USDT (April 9, 2026); approximately $2.08 million in USDC (April 11, 2026); and approximately $1.95 million in a combination of Bitcoin, ETH, and staked ETH (April 8, 2026). At least three victims suffered seven-figure losses. ZachXBT identified two Bitcoin transaction hashes in connection with the investigation: 6f5c8eb6b01774626f33527e0cb03c0d1860447acacd6079e69bf41b459bcf1f and 9ee1288f941b2c3775ebd125eefeebdc713aa160bf2cf9d18661fd07f84ce891. Assets were stolen across multiple blockchain networks including Bitcoin, Ethereum, Solana, Tron, and XRP Ledger. The $9.5 million figure represents confirmed losses documented by ZachXBT and is described as a floor estimate; the actual total may be higher as additional victims may not have come forward. No funds have been publicly reported as recovered as of late April 2026.","heading":"Financial Impact and Victim Losses","severity":"critical","sources":[{"credibility":2,"name":"ZachXBT Says Apple App Store Fake Ledger App Stole $9.5M From 50+ Victims in One Week - Bitcoin.com News","type":"news_article","url":"https://news.bitcoin.com/zachxbt-says-apple-app-store-fake-ledger-app-stole-9-5m-from-50-victims-in-one-week/"},{"credibility":2,"name":"Fake Ledger App on Apple Store Linked to $9.5M Theft - CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/fake-ledger-app-apple-app-store-9-5m-crypto-theft-zachxbt"},{"credibility":2,"name":"Fake Ledger Live App on Apple Store Linked to $9.5M Crypto Theft - HackRead","type":"news_article","url":"https://hackread.com/fake-ledger-live-app-apple-store-crypto-theft/"},{"credibility":2,"name":"Fake Ledger App Alert: $9.5M Stolen From 50+ Victims via Apple App Store, Funds Laundered via KuCoin - CCN","type":"news_article","url":"https://www.ccn.com/education/crypto/fake-ledger-app-9-5m-stolen-50-victims-kucoin-laundering/"}]},{"content":"Garrett Dutton, known professionally as G. Love (frontman of G. Love & Special Sauce), publicly disclosed that he lost approximately 5.92 BTC — his entire decade-long savings in Bitcoin, valued at approximately $420,000-$447,000 at the time of the theft — on approximately April 11, 2026. Dutton stated he was setting up a Ledger hardware wallet on a new Apple computer and searched the App Store for the official Ledger Live application, downloading the fraudulent version by mistake. After entering his 24-word seed phrase as prompted by the fake app, his Bitcoin holdings were drained. Dutton disclosed the loss publicly on the social platform X. ZachXBT confirmed the stolen 5.92 BTC was traced through KuCoin deposit addresses consistent with the broader laundering operation. Dutton's case drew significant media attention and highlighted that technically unsophisticated users searching good-faith app stores remain highly vulnerable to impersonation attacks.","heading":"Notable Victim: Musician G. Love","severity":"high","sources":[{"credibility":2,"name":"Fake Ledger App Steals Millions in Bitcoin, Crypto From Holders — Including Musician G. Love - Decrypt","type":"news_article","url":"https://decrypt.co/364308/fake-ledger-app-steals-millions-bitcoin-crypto-musician-g-love"},{"credibility":2,"name":"Philadelphia Musician G. Love Loses Nearly 6 BTC to Fake Ledger Wallet App - Bitcoin.com News","type":"news_article","url":"https://news.bitcoin.com/philadelphia-musician-g-love-loses-nearly-6-btc-to-fake-ledger-wallet-app-on-apples-app-store/"},{"credibility":2,"name":"Fake Ledger Live app on Apple App Store drains 5.9 BTC from G. Love - Crypto.news","type":"news_article","url":"https://crypto.news/fake-ledger-live-app-on-apple-app-store-drains-5-9-btc-from-g-love/"}]},{"content":"ZachXBT's on-chain analysis traced the stolen assets through a multi-step laundering network. Proceeds were transferred through more than 150 deposit addresses on the KuCoin cryptocurrency exchange. The funds were then linked to a centralized mixing service referred to as 'AudiA6,' described as a high-fee service that processes illicit funds in exchange for a percentage cut, designed to obfuscate the origin of the transactions. KuCoin stated it monitors suspicious activity per regulatory standards and froze certain suspect accounts, though it declined to provide details citing security and privacy considerations. Reports noted a KuCoin account freeze deadline of around April 20, 2026, pending potential law enforcement extension. KuCoin itself had been fined over $300 million by U.S. authorities for anti-money laundering violations in 2025 and was barred from onboarding new EU users by Austrian regulators in February 2026 under MiCA. No funds were reported recovered as of late April 2026. ZachXBT noted that full recovery would require coordinated law enforcement action and voluntary exchange cooperation, which he described as unlikely given the structure of the laundering network.","heading":"Money Laundering Route","severity":"critical","sources":[{"credibility":2,"name":"ZachXBT: Fake Ledger Live app leads to $9.5 million theft; funds laundered via KuCoin - PANews","type":"on_chain","url":"https://www.panewslab.com/en/articles/019d8b8e-50f4-740b-bbc8-9266fb253d49"},{"credibility":2,"name":"Fake Ledger app on Apple App Store linked to $9.5M crypto theft across Bitcoin, Tron, Solana: ZachXBT - The Block","type":"news_article","url":"https://www.theblock.co/post/397388/fake-ledger-app-apple-app-store-crypto-theft-bitcoin-tron-solana-zachxbt"},{"credibility":2,"name":"Bogus crypto wallet on App Store steals $9.5M - AppleInsider","type":"news_article","url":"https://appleinsider.com/articles/26/04/14/bogus-crypto-wallet-on-app-store-steals-95m"}]},{"content":"Apple confirmed to 9to5Mac that it has 'zero tolerance for fraudulent or malicious apps' and stated that the developer account associated with the fake Ledger Live app was terminated alongside its removal from the App Store. Apple did not issue an official standalone press release. The app was removed on or around April 13-14, 2026, after user reports and media coverage made the scam public — not through Apple's own proactive detection systems. How the application passed Apple's review process was not publicly explained. It is established that reports of stolen funds began appearing as early as April 7, 2026 — approximately one week before Apple removed the app. This gap of approximately seven days between the first victim reports and removal drew significant criticism. Apple's review process did not flag the discrepancy between the publisher name 'Leva Heal Limited' (a UK company with SIC codes for manufacturing and medical practice) and the well-known Ledger hardware wallet brand. ZachXBT publicly suggested the documented losses could form the basis of a class-action lawsuit against Apple regarding its duty of care obligations and representations about App Store security. A report noted that lawsuits had been filed or were anticipated, alleging Apple misrepresented the App Store as a secure distribution channel. As of April 2026, no confirmed class-action filing had been publicly docketed.","heading":"Apple's Response and App Store Review Failure","severity":"high","sources":[{"credibility":2,"name":"Apple pulls fake Ledger app and Freecash in rough day for App Store review - 9to5Mac","type":"news_article","url":"https://9to5mac.com/2026/04/14/apple-pulls-fake-ledger-app-and-freecash-in-rough-day-for-app-store-review/"},{"credibility":2,"name":"Apple Removes Fake Crypto Wallet App That Stole $9.5 Million From Mac Users - MacRumors","type":"news_article","url":"https://www.macrumors.com/2026/04/14/apple-mac-app-store-fake-crypto-wallet/"},{"credibility":2,"name":"What's the point of the App Store, if it can't protect users? - Macworld","type":"news_article","url":"https://www.macworld.com/article/3115356/whats-the-point-of-the-app-store-if-it-cant-protect-users.html"},{"credibility":3,"name":"Fake App on Apple Store Fuels $9.5M Crypto Heist, Lawsuits Filed - Whalesbook","type":"news_article","url":"https://www.whalesbook.com/news/English/crypto/Fake-App-on-Apple-Store-Fuels-dollar95M-Crypto-Heist-Lawsuits-Filed/69de2713b842ce1386badb2a"}]},{"content":"Ledger SAS's Chief Technology Officer Charles Guillemet issued a public statement warning that the legitimate Ledger Live application 'will never ask for your 24 words.' Guillemet added: 'If anyone, or any app, is asking for your 24 words, assume something is wrong.' Guillemet further stated that 'you cannot trust the software environment around you — not your browser, not your app store, not your desktop,' and warned that attackers 'operate wherever the opportunity exists.' Ledger noted that its official macOS Ledger Live software is not distributed through the Apple App Store; the company distributes exclusively through its own website (ledger.com). Ledger has historically warned users against downloading its software from any third-party source. No direct financial compensation or victim recovery program was announced by Ledger in connection with this incident.","heading":"Ledger's Official Response","severity":"medium","sources":[{"credibility":2,"name":"Fake Ledger App on Apple Store Linked to $9.5M Theft - CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/fake-ledger-app-apple-app-store-9-5m-crypto-theft-zachxbt"},{"credibility":2,"name":"Bogus crypto wallet on App Store steals $9.5M - AppleInsider","type":"news_article","url":"https://appleinsider.com/articles/26/04/14/bogus-crypto-wallet-on-app-store-steals-95m"},{"credibility":2,"name":"9 Ledger Wallet Scams You Need to Know About in 2026 to Stay Safe - Crypto Legal","type":"news_article","url":"https://www.cryptolegal.uk/9-ledger-wallet-scams-need-to-know-in-2026/"}]},{"content":"As of late April 2026, no public law enforcement action — criminal charges, indictments, asset seizures, or regulatory sanctions — had been announced in connection with the Leva Heal Limited fake Ledger Live app scheme. KuCoin stated it froze certain suspect accounts and cooperated with requests, though no confirmed fund recovery was reported. ZachXBT's investigation provided on-chain tracing and publicly documented the laundering network, but the underlying attackers had not been publicly identified or arrested. The use of the AudiA6 mixing service and the dispersion of funds across 150+ KuCoin deposit addresses was noted as significantly complicating any recovery or attribution effort. Class-action litigation against Apple was alleged to be under consideration or filed by unnamed plaintiffs as of mid-April 2026, though no confirmed court filing was publicly identified. No action by the U.S. SEC, FTC, FBI, UK FCA, or other regulatory body had been publicly reported in connection with this specific incident as of the time of reporting.","heading":"Law Enforcement and Regulatory Action","severity":"medium","sources":[{"credibility":2,"name":"Fake Ledger App Alert: $9.5M Stolen From 50+ Victims via Apple App Store, Funds Laundered via KuCoin - CCN","type":"news_article","url":"https://www.ccn.com/education/crypto/fake-ledger-app-9-5m-stolen-50-victims-kucoin-laundering/"},{"credibility":2,"name":"Fake Ledger app on Apple App Store linked to $9.5M crypto theft across Bitcoin, Tron, Solana: ZachXBT - The Block","type":"news_article","url":"https://www.theblock.co/post/397388/fake-ledger-app-apple-app-store-crypto-theft-bitcoin-tron-solana-zachxbt"}]},{"content":"The Leva Heal Limited fake Ledger Live incident is not an isolated case. Reports filed in connection with alleged class-action litigation against Apple referenced prior fraudulent crypto wallet applications hosted on the App Store, including apps identified as Swiftcrypt, Digicoins, SolLuna, and Forex5, suggesting a recurring pattern of impersonation applications passing the review process. The fake Ledger Live app incident represents the most financially damaging individual instance yet documented on the macOS or iOS App Store. The scale and speed of victim losses — $9.5 million across 50 users in approximately one week — underscores the heightened risk posed by seed-phrase-harvesting applications that impersonate hardware wallet companion software targeting high-value cryptocurrency holders.","heading":"Pattern Context: Prior Fake Crypto Apps on the App Store","severity":"high","sources":[{"credibility":3,"name":"Fake App on Apple Store Fuels $9.5M Crypto Heist, Lawsuits Filed - Whalesbook","type":"news_article","url":"https://www.whalesbook.com/news/English/crypto/Fake-App-on-Apple-Store-Fuels-dollar95M-Crypto-Heist-Lawsuits-Filed/69de2713b842ce1386badb2a"},{"credibility":2,"name":"A Fake Ledger App Passed Apple's Review and Stole $9.5M in Crypto - gBlock","type":"news_article","url":"https://www.gblock.app/articles/fake-ledger-app-apple-store-crypto-theft"},{"credibility":2,"name":"Fake Ledger app scam: $9.5M crypto theft via Apple App Store - 1inch Blog","type":"news_article","url":"https://blog.1inch.com/fake-app-store-app/"}]}],"sources_used":[{"credibility":1,"name":"LEVA HEAL LIMITED overview - Companies House (GOV.UK)","type":"official","url":"https://find-and-update.company-information.service.gov.uk/company/12178110"},{"credibility":1,"name":"LEVA HEAL LIMITED persons with significant control - Companies House (GOV.UK)","type":"official","url":"https://find-and-update.company-information.service.gov.uk/company/12178110/persons-with-significant-control"},{"credibility":1,"name":"LEVA HEAL LIMITED officers - Companies House (GOV.UK)","type":"official","url":"https://find-and-update.company-information.service.gov.uk/company/12178110/officers"},{"credibility":1,"name":"A fake Ledger app on the Apple App Store drained $9.5 million in crypto - CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/04/14/a-fake-ledger-app-on-the-apple-app-store-just-drained-usd9-5-million-in-crypto"},{"credibility":2,"name":"Fake Ledger Live app on Apple's App Store stole $9.5M in crypto - BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto/"},{"credibility":2,"name":"Fake Ledger app on Apple App Store linked to $9.5M crypto theft across Bitcoin, Tron, Solana: ZachXBT - The Block","type":"news_article","url":"https://www.theblock.co/post/397388/fake-ledger-app-apple-app-store-crypto-theft-bitcoin-tron-solana-zachxbt"},{"credibility":2,"name":"Fake Ledger App on Apple Store Linked to $9.5M Theft - CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/fake-ledger-app-apple-app-store-9-5m-crypto-theft-zachxbt"},{"credibility":2,"name":"Apple pulls fake Ledger app and Freecash in rough day for App Store review - 9to5Mac","type":"news_article","url":"https://9to5mac.com/2026/04/14/apple-pulls-fake-ledger-app-and-freecash-in-rough-day-for-app-store-review/"},{"credibility":2,"name":"Bogus crypto wallet on App Store steals $9.5M - AppleInsider","type":"news_article","url":"https://appleinsider.com/articles/26/04/14/bogus-crypto-wallet-on-app-store-steals-95m"},{"credibility":2,"name":"Apple Removes Fake Crypto Wallet App That Stole $9.5 Million From Mac Users - MacRumors","type":"news_article","url":"https://www.macrumors.com/2026/04/14/apple-mac-app-store-fake-crypto-wallet/"},{"credibility":2,"name":"Fake Ledger App Steals Millions in Bitcoin, Crypto From Holders — Including Musician G. Love - Decrypt","type":"news_article","url":"https://decrypt.co/364308/fake-ledger-app-steals-millions-bitcoin-crypto-musician-g-love"},{"credibility":2,"name":"Philadelphia Musician G. Love Loses Nearly 6 BTC to Fake Ledger Wallet App - Bitcoin.com News","type":"news_article","url":"https://news.bitcoin.com/philadelphia-musician-g-love-loses-nearly-6-btc-to-fake-ledger-wallet-app-on-apples-app-store/"},{"credibility":2,"name":"Fake Ledger Live app on Apple App Store drains 5.9 BTC from G. Love - Crypto.news","type":"news_article","url":"https://crypto.news/fake-ledger-live-app-on-apple-app-store-drains-5-9-btc-from-g-love/"},{"credibility":2,"name":"ZachXBT: Fake Ledger Live app leads to $9.5 million theft; funds laundered via KuCoin - PANews","type":"on_chain","url":"https://www.panewslab.com/en/articles/019d8b8e-50f4-740b-bbc8-9266fb253d49"},{"credibility":2,"name":"Fake Ledger Alert: $9.5M Stolen From 50+ Victims via Apple App Store, Funds Laundered via KuCoin - CCN","type":"news_article","url":"https://www.ccn.com/education/crypto/fake-ledger-app-9-5m-stolen-50-victims-kucoin-laundering/"},{"credibility":2,"name":"Fake Ledger app on the Apple App Store steals $9.5 million from 50 users - CyberInsider","type":"news_article","url":"https://cyberinsider.com/fake-ledger-app-on-the-apple-app-store-steals-9-5-million-from-50-users/"},{"credibility":2,"name":"Fake Ledger app on Mac app store scams users out of $9.5 million - SC Media","type":"news_article","url":"https://www.scworld.com/brief/fake-ledger-app-on-mac-app-store-scams-users-out-of-9-5-million"},{"credibility":2,"name":"Fake Ledger App on Apple Store Drains $9.5M in Week-Long Scam - Blockchain.news","type":"news_article","url":"https://blockchain.news/news/fake-ledger-app-apple-store-9-5m-theft-april-2026"},{"credibility":3,"name":"Fake App on Apple Store Fuels $9.5M Crypto Heist, Lawsuits Filed - Whalesbook","type":"news_article","url":"https://www.whalesbook.com/news/English/crypto/Fake-App-on-Apple-Store-Fuels-dollar95M-Crypto-Heist-Lawsuits-Filed/69de2713b842ce1386badb2a"},{"credibility":3,"name":"Fake Ledger Live app on Apple's App Store stole $9.5M in crypto - PRSOL","type":"news_article","url":"https://www.prsol.cc/2026/04/20/fake-ledger-live-app-on-apples-app-store-stole-9-5m-in-crypto/"}],"summary":"Leva Heal Limited is a UK-registered company (Companies House number 12178110) whose Apple developer account was used to publish a fraudulent application impersonating Ledger Live on the macOS App Store between April 7 and April 13, 2026. The app harvested users' 24-word seed phrases, resulting in the theft of approximately $9.5 million in cryptocurrency from at least 50 victims. Apple removed the app and terminated the associated developer account on or around April 13-14, 2026, after community reports surfaced through on-chain investigator ZachXBT.","timeline":[{"date":"2019-08-28","event":"Leva Heal Limited incorporated in England and Wales under the name Khiron Life Sciences UK Limited (Companies House number 12178110).","source":"Companies House (GOV.UK)","source_url":"https://find-and-update.company-information.service.gov.uk/company/12178110"},{"date":"2024-09-10","event":"Company renamed from Khiron Life Sciences UK Limited to Leva Heal Limited.","source":"Companies House (GOV.UK)","source_url":"https://find-and-update.company-information.service.gov.uk/company/12178110"},{"date":"2025-01-01","event":"Michael Anthony Steele (Canadian national) becomes person with significant control (75%+ shares and voting rights) of Leva Heal Limited.","source":"Companies House (GOV.UK)","source_url":"https://find-and-update.company-information.service.gov.uk/company/12178110/persons-with-significant-control"},{"date":"2026-04-07","event":"Fraudulent 'Ledger Live' app published on Apple macOS App Store under developer name 'Leva Heal Limited'; first victim fund thefts begin.","source":"BleepingComputer / CoinDesk / The Block","source_url":"https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto/"},{"date":"2026-04-08","event":"First documented large theft: approximately $1.95 million in Bitcoin, ETH, and staked ETH stolen from a single victim.","source":"CoinDesk / HackRead","source_url":"https://www.coindesk.com/business/2026/04/14/a-fake-ledger-app-on-the-apple-app-store-just-drained-usd9-5-million-in-crypto"},{"date":"2026-04-09","event":"Second large documented theft: approximately $3.23 million in USDT stolen from a single victim.","source":"CoinDesk / CoinTelegraph","source_url":"https://cointelegraph.com/news/fake-ledger-app-apple-app-store-9-5m-crypto-theft-zachxbt"},{"date":"2026-04-11","event":"Third large documented theft: approximately $2.08 million in USDC stolen from a single victim. Musician G. Love (Garrett Dutton) also loses 5.92 BTC (approximately $420,000-$447,000) after entering his seed phrase into the fake app.","source":"Decrypt / Bitcoin.com News / CoinDesk","source_url":"https://decrypt.co/364308/fake-ledger-app-steals-millions-bitcoin-crypto-musician-g-love"},{"date":"2026-04-13","event":"App removed from Apple App Store. Apple terminates the associated developer account.","source":"9to5Mac / MacRumors / AppleInsider","source_url":"https://9to5mac.com/2026/04/14/apple-pulls-fake-ledger-app-and-freecash-in-rough-day-for-app-store-review/"},{"date":"2026-04-14","event":"ZachXBT publishes public investigation report linking fake Ledger Live app to $9.5 million theft from 50+ victims; major media coverage begins. CoinDesk, AppleInsider, The Block report on the incident.","source":"The Block / CoinDesk / AppleInsider","source_url":"https://www.theblock.co/post/397388/fake-ledger-app-apple-app-store-crypto-theft-bitcoin-tron-solana-zachxbt"},{"date":"2026-04-15","event":"Ledger CTO Charles Guillemet issues public statement warning users that the real Ledger Live 'will never ask for your 24 words.'","source":"CoinTelegraph / BleepingComputer","source_url":"https://cointelegraph.com/news/fake-ledger-app-apple-app-store-9-5m-crypto-theft-zachxbt"},{"date":"2026-04-20","event":"Alleged KuCoin account freeze deadline cited in connection with stolen funds held at KuCoin deposit addresses; no confirmed fund recovery reported.","source":"AppleInsider","source_url":"https://appleinsider.com/articles/26/04/14/bogus-crypto-wallet-on-app-store-steals-95m"}]},"v":1}