Incident case file
Sign in to watchG. Love Wallet Drain — Fake Ledger Live App on Apple Mac App Store (Seed-Phrase Phishing)
0 views
Estimated loss
Victims identified
Investigation
Facts and investigation
Attacker: Series of 9 BTC tx hashes published by ZachXBT on Telegram, consolidated into 150+ KuCoin deposit addresses
Timeline: April 7-13, 2026: Fake Ledger Live app distributed via Apple Mac App Store; 50+ victims enter 24-word seed phrases; >$9.5M drained in aggregate. April 11: Garrett Dutton (musician G. Love) downloads the fake app while migrating his hardware wallet to a new Mac, enters seed phrase; 5.92 BTC drained almost instantly across 9 transactions. April 13: Apple removes the malicious app; ZachXBT publishes traces on Telegram. April 14: ZachXBT publicly criticizes KuCoin for enabling laundering and Apple for blocking documentation scans.
Sources and coverage
- Articlecryptotimes.iohttps://www.cryptotimes.io/2026/04/13/zachxbt-slams-apple-after-musician-loses-424k-bitcoin-to-fake-ledger-app/
- Articlecoindesk.comhttps://www.coindesk.com/business/2026/04/14/a-fake-ledger-app-on-the-apple-app-store-just-drained-usd9-5-million-in-crypto
- Articlecryptotimes.iohttps://www.cryptotimes.io/2026/04/14/zachxbt-claims-kucoin-enabled-laundering-of-over-13m-in-recent-thefts/
- Articletradingview.comhttps://www.tradingview.com/news/cointelegraph:f9cd9ea0b094b:0-fake-ledger-live-app-on-apple-app-store-drained-9-5m-from-victims-zachxbt/
Victim testimonies
No testimonies yet.
+ Add my testimony → (coming soon)