Fake Crypto App Bypasses Apple App Store Review, Drains $23K from 27 Solana Wallets
In late October 2026, a fraudulent cryptocurrency trading application named Padre Terminal was discovered on Apple's App Store, where it had been available to iOS users. The malicious app impersonated the legitimate Padre Terminal trading service (now Terminal by pump.fun), a web-only Solana meme coin platform. After unsuspecting users imported their private keys into the fake app, attackers drained funds from 27 Solana wallets, stealing approximately $23,000 in cryptocurrency. The stolen assets were traced to a single Solana address, and the attacker actively converted USDC holdings to SOL to evade potential freezing by Circle, then moved funds to a secondary wallet. The app continued draining wallets even after Apple removed it from the store. This incident is part of a growing wave of mobile crypto-drainer campaigns exploiting trusted app marketplaces. Blockchain security researchers identified at least five suspected crypto-brand impersonators simultaneously active on the App Store, some sharing common backend infrastructure, pointing to organized threat actors targeting DeFi and meme coin traders. The incident underscores that even curated app stores are not immune to sophisticated social engineering and supply chain impersonation attacks.
Kill Chain
