Apple is facing a federal lawsuit in California after three cryptocurrency investors lost a combined $1.8 million, approximately Rs 15.78 crore, in Bitcoin to a fraudulent application on its App Store that impersonated Sparrow Wallet, a legitimate and widely used Bitcoin management tool that has never released an iOS version. The complaint, filed on 24 July in the US District Court for the Northern District of California, argues that the fraud succeeded specifically because Apple spent over a decade marketing the App Store as a uniquely safe and trusted environment, and that this manufactured trust is precisely what the scammers exploited.
How the Scam Was Engineered
Sparrow Wallet is available only on Windows, macOS and Linux and has never had a legitimate iOS version. Scammers have repeatedly published fake lookalike applications in the App Store impersonating the wallet and using its name, branding and interface to trick users into surrendering control of their funds.
The mechanism of theft is particularly effective in the context of self-custody cryptocurrency wallets. Upon opening the fraudulent application, users were prompted to import their existing Bitcoin wallets by entering their 12 or 24-word recovery seed phrases. Once entered, these phrases were transmitted directly to attacker-controlled infrastructure, enabling instantaneous fund transfers. A seed phrase is the master key to a cryptocurrency wallet: anyone who possesses it has complete and irreversible control over every asset stored in that wallet. There is no bank, no regulator and no reversal mechanism once those funds have moved.
Jalen Delgado downloaded the application on 1 May 2025 and lost approximately $120,000. James Ramirez lost 7.4 Bitcoin valued at roughly $875,000 on 25 July 2025 and reported the fraudulent listing to Apple that same day. Christopher Ellis downloaded the same fraudulent application nine days later on 3 August 2025 and lost approximately $840,000, indicating the listing remained active despite the prior victim’s report.
The Developer Tried to Warn Apple and Was Blocked
One of the most damaging details in the complaint involves the conduct of Sparrow Wallet’s own developer, Craig Raw, who has documented the fake app problem on the App Store since 2023. Raw attempted to submit an official placeholder application to the App Store warning potential downloaders that Sparrow Wallet is a desktop-only application and that any iOS version claiming to be Sparrow was a scam. Apple’s review systems flagged and rejected the placeholder for having “placeholder content” and only “demonstrating a concept” rather than being a real application.
The irony is precise: Apple’s automated gatekeeping mechanisms rejected a legitimate developer’s attempt to protect users while allowing an impersonation application harvesting seed phrases to remain live and operational. The complaint frames this as evidence not of isolated oversight but of systemic failure in Apple’s review architecture, one that is structurally weighted toward functional completeness rather than identity verification.
The lawsuit accuses Apple of violating California’s Consumers Legal Remedies Act along with consumer protection laws in Louisiana and Massachusetts, and asks the court to require Apple to strengthen its App Store review process and warning systems for fraudulent crypto applications. This is not the first major crypto scam to exploit Apple’s ecosystem in recent months. In April 2026, a counterfeit version of Ledger Live appeared on the Mac App Store and managed to steal over $9.5 million from more than 50 victims across Bitcoin, Ethereum and Solana holdings.
What the Case Means Beyond the Courtroom
Apple has stated that it took swift action to remove applications impersonating Sparrow Wallet and terminate the associated developer accounts, and that there are currently no Sparrow Wallet copycats active on the platform. The company has not commented on the lawsuit directly.
The legal questions the case raises, however, extend well beyond the three plaintiffs. Apple’s control over iOS app distribution is total: unlike Android, users cannot install applications from any source other than the App Store without circumventing the operating system. This exclusivity is the commercial and competitive foundation of Apple’s security pitch. The lawsuit argues that this degree of control carries a corresponding degree of responsibility, and that a platform that markets total control cannot simultaneously disclaim liability when that control fails.
For Indian cryptocurrency investors, who number in the crores and increasingly interact with the global crypto market through mobile applications, the implications are significant. The seed phrase vulnerability exploited in the Sparrow case is not unique to that wallet. Any application that requests a recovery phrase during setup should be treated as suspicious by default, regardless of the platform it appears on.
Prof. Triveni Singh, cybercrime expert and former IPS officer, advises that the first step before downloading any cryptocurrency or financial application is to visit the developer’s official website and verify whether an iOS version exists at all. He stresses that entering a wallet’s seed phrase or private key into any unverified application is an irreversible act, and that no legitimate cryptocurrency wallet requests seed phrase entry as a routine import mechanism without extensive user warnings.
