A fraudulent cryptocurrency trading application previously available on Apple’s App Store has been linked to the theft of approximately $23,000 from 27 Solana wallets. The application, named Padre Terminal, allegedly tricked users into entering their private wallet keys, allowing attackers to steal cryptocurrency.
Although the app has since been removed, investigators found that the wallet-draining operation continued, raising concerns about fraudulent financial applications appearing on trusted app marketplaces.
How Did the Fake Crypto App Work?
The malicious application impersonated Padre, a cryptocurrency trading platform used primarily for buying and selling meme coins on the Solana blockchain. The legitimate service was subsequently renamed Terminal by pump.fun and operates through a website rather than a dedicated mobile application.
Fraudsters allegedly exploited the platform’s identity by creating an imitation application for iPhone users. Blockchain investigator Iris confirmed that one victim had been compromised through the fraudulent application. However, the researcher could not establish how the other affected wallets were compromised. The application allegedly stole cryptocurrency after users entered their private wallet keys.
How Much Cryptocurrency Was Stolen?
Investigators connected the operation to approximately $23,000 in cryptocurrency losses across 27 Solana wallets since October 25, 2026.
The stolen assets were traced through blockchain transactions. On October 29, the attacker reportedly converted 4,070 USDC tokens into Solana’s SOL cryptocurrency, removing the possibility of those particular stablecoin funds being frozen by Circle.
The attacker subsequently transferred 192 SOL to another wallet.
https://the420.in/fcrf-certified-chief-ai-officer-second-cohort-november-2026/
Researchers found that two wallets associated with the operation held a combined 229.66 SOL, with no withdrawals into cash identified at the time of their examination.
Was the App Removed From Apple’s Store?
The fraudulent Padre Terminal application was removed from Apple’s App Store following its discovery. Its listing subsequently became inaccessible, returning an error when users attempted to open it.
However, investigators found that the associated cryptocurrency theft operation remained active even after the application’s removal. The latest identified theft occurred on October 29, indicating that deleting the application listing did not immediately stop the suspected attacker.
Were Other Suspicious Applications Discovered?
Iris identified at least five suspected applications impersonating cryptocurrency-related services on Apple’s App Store.
These included Padre Terminal, Axiom Pro: Focus, GMGN AI, HyperTerminal-HyperliquidTools and Pump Fun Tokens & Analytics.
Several applications had ordinary-looking descriptions, while customer reviews contained allegations of cryptocurrency theft.
Axiom Pro: Focus had approximately 25 reviews alleging wallet theft since February.
Reviews associated with GMGN AI and HyperTerminal-HyperliquidTools separately alleged losses of $2,000 and $2,020. However, investigators had not independently confirmed cryptocurrency theft involving the four other suspicious applications.
What Did Investigators Find About the Network
Investigators identified technical connections between some suspected cryptocurrency impersonation operations. A script associated with a fake Axiom website contained backend addresses linked to Axiom, Aster and GMGN impersonators, suggesting possible shared infrastructure.
Padre Terminal, however, was not connected to that cluster. The findings suggested that multiple fraudulent applications could be targeting cryptocurrency users through similar impersonation methods.
The420 Insight: How Can Crypto Users Stay Safe?
The incident highlights the dangers of trusting cryptocurrency applications solely because they appear on an official app marketplace. Users should verify whether a cryptocurrency platform offers an authorised mobile application before downloading it.
Checking the project’s official website, reviewing the developer’s identity and examining user complaints can help identify suspicious applications. Private wallet keys should never be entered into unverified applications, as doing so can give criminals access to cryptocurrency holdings.
