Apple App Store Security Breach Leads to $9.5 Million Crypto Theft

A sophisticated phishing campaign distributed via the Apple App Store has resulted in the theft of at least $9.5 million in digital assets. The fraudulent app, masquerading as the official Ledger Live wallet, targeted users between April 7 and April 13, leading to devastating losses for over 50 victims, some of whom lost their entire retirement savings. The incident underscores critical vulnerabilities in app store vetting processes and the persistent risk of social engineering in the digital asset space. By tricking users into entering their recovery phrases, attackers gained full control over private keys across multiple networks, including Bitcoin, Ethereum, Solana, and XRP. Blockchain analysis revealed high-value thefts, including $3.23 million in USDT on April 9 and $2.08 million in USDC on April 11. One victim reported the loss of 5.9 BTC, representing a decade of accumulated savings. The stolen funds were routed through more than 150 KuCoin deposit addresses and the 'AudiA6' mixing service to obfuscate the transaction trail. While Apple has since removed the malicious application, the breach may trigger legal repercussions, including potential class-action lawsuits. The use of KuCoin as a laundering hub further complicates the situation, given the exchange's existing regulatory friction with U.S. and EU authorities, including a recent ban on onboarding new EU users by Austrian regulators.