Fake Ledger Live app in Apple's App Store
Who is affected
Mac users who installed the fake app and entered their recovery phrase lost about $9.5 million in total, according to ZachXBT. Ledger states it never asks for the recovery phrase.
What happened
A fraudulent Ledger Live application was available in Apple’s App Store in April 2026. BleepingComputer describes it as a macOS app, notes that Ledger distributes its Mac app from its own website and offers only an iOS version in the App Store, and reports, citing a Reddit discussion, that it was published under the name “Leva Heal Limited”, which is not associated with Ledger.
According to BleepingComputer, users who installed the app were led to enter their recovery phrase, which gave the attackers full access to their wallets. The Block reports that ZachXBT traced funds drained between 7 and 13 April 2026 across Bitcoin, EVM networks, Tron, Solana and Ripple, and that the assets were moved through more than 150 KuCoin deposit addresses linked to a mixing service; BleepingComputer reports KuCoin said it froze the accounts involved.
Apple removed the app and terminated the developer’s account after user reports, according to BleepingComputer’s update of 15 April 2026. Ledger CTO Charles Guillemet told The Block that Ledger never asks for the 24-word recovery phrase and warned that official app stores can host fraudulent apps.
What Ledger advises:
- Never enter your recovery phrase into any app or website; Ledger never asks for it.
- Download wallet software only from Ledger’s official website.
Ledger Live is a software application that manages cryptocurrency assets and interacts with Ledger hardware wallets for secure transactions and portfolio management.
Read full definitionA mnemonic phrase is a set of words that stores a cryptocurrency wallet's private keys, allowing users to recover access if lost.
Read full definitionBitcoin (BTC) is the first decentralized cryptocurrency, launched in 2009. It uses blockchain technology for secure, peer-to-peer digital transactions without intermediaries.
Read full definitionThe EVM (Ethereum Virtual Machine) runs smart contracts on Ethereum and on compatible chains, which share its address format and tooling.
Read full definitionTRON is a blockchain platform and cryptocurrency (TRX) designed for high-throughput decentralized applications, especially in content sharing and entertainment.
Read full definitionSolana is a high-performance layer-1 blockchain platform that enables fast, low-cost transactions using Proof of History and Proof of Stake. Its native token is SOL.
Read full definitionThe XRP Ledger is a decentralized, open-source blockchain designed for fast, low-cost global payments using the XRP cryptocurrency.
Read full definitionA wallet address is the public identifier others use to send you crypto. It is derived from a public key and is safe to share.
Read full definitionRecovery is the process of restoring access to a cryptocurrency wallet using its seed phrase or mnemonic backup if the original wallet is lost or inaccessible.
Read full definitionSources
Independent reporting and research this entry was checked against.
Learn more
Guides on protecting yourself against this type of incident (Targeted phishing) and the glossary terms that describe it.
How to Avoid Phishing Attacks
Phishing is the #1 way people lose crypto. Learn to spot fake emails, websites, and apps before they steal your funds.
Read GuidePhishing Defense: Protecting Your Hardware Wallet from Social Engineering
Fake websites, spoofed emails, malicious dApps — how phishing attacks target hardware wallet users and how to spot them every time.
Read GuideCommon Crypto Scams in 2026
Scammers stole billions in 2024. Learn the latest tactics — phishing, fake apps, social engineering — and how to avoid them.
Read GuidePhishing Attack
A phishing attack tricks crypto users into revealing private keys, seed phrases, or login details via fake emails, websites, or messages mimicking legitimate wallets or exchanges.
Crypto Scam
A Crypto Scam is a fraudulent scheme that tricks people into sending cryptocurrency or sharing private keys for financial gain.
Cite this entry
WalletInsights. “Fake Ledger Live app in Apple's App Store”. Hardware wallet security incident tracker. Last verified November 3, 2026. https://walletinsights.io/en/security-incidents/fake-ledger-live-apple-app-store-2026/
Corrections and right of reply
Vendors, researchers and readers can send corrections or statements to security@walletinsights.io. We check them against the sources, update the entry and record the change in its log.
All Ledger incidents
- Hardware implants in Ledger devices sold by CryptoBilis
- Ledger Ethereum app clear-signing bypass hid all but one operation of a large batch
- Ledger Ethereum app swap flow could sign a token approval in place of a payment
- Ledger Secure SDK flaw let a host change transaction details after on-screen review
- Ledger Monero app exposed Keccak state, letting a compromised host recover spend keys