Crypto Stealing Wallet Apps Proliferate in Apple App Store

Why It Matters

The attack demonstrates a new vector for crypto theft on iOS, exposing millions of users to irreversible losses and pressuring platform owners to tighten app vetting.

Key Takeaways

• 26 fake wallet apps removed from Apple Store
• Apps mimicked Coinbase, MetaMask, OneKey, Trust Wallet
• Malware stole seed phrases via provisioning profile phishing
• Potential global impact beyond Chinese victims

Pulse Analysis

The FakeWallet campaign underscores a growing sophistication in mobile crypto fraud, leveraging Apple’s provisioning profile mechanism to bypass traditional app‑store safeguards. By disguising malicious code as legitimate wallet applications, attackers trick users into installing software that silently harvests seed phrases— the cryptographic keys that grant full control over digital assets. Once captured, these phrases allow thieves to empty wallets instantly, leaving victims with no recourse. This method differs from classic phishing by embedding the exploit directly into a seemingly authentic iOS app, complicating detection for both users and security tools.

For the broader cryptocurrency ecosystem, the incident raises alarm bells about the security of mobile access points. While the current victims are primarily Chinese users, the lack of geographic restrictions means the same approach could be weaponized against any iOS user worldwide. The $9.5 million loss from a prior fake Ledger Live app illustrates the high‑stakes nature of such attacks, where a single compromised app can jeopardize tens of millions in digital wealth. Financial services and wallet providers must therefore prioritize robust code‑signing verification, continuous monitoring of app store listings, and user education on the dangers of unofficial downloads.

Regulators and platform operators are now under pressure to tighten vetting processes and improve rapid response mechanisms. Apple’s removal of the 26 apps shows responsiveness, yet the recurrence of similar schemes suggests a need for more proactive threat intelligence sharing with security firms like Kaspersky. Meanwhile, investors and developers should consider multi‑factor authentication and hardware wallet adoption to mitigate the risk of seed‑phrase theft. As the crypto market matures, safeguarding the mobile entry points will be pivotal to maintaining user confidence and preventing further erosion of trust in digital finance.