A fake Mac application, designed to look like the real one, "slipped through" Apple's app review team, costing users about $9.5 million in cryptocurrencies.
According to CoinDesk, the fake macOS version of the Ledger Live crypto wallet app tricked people into granting access to their cryptocurrency wallets. More than 50 people fell victim to the fake app between April 7 and 13.
Ledger has an official Mac application, but it is distributed via the Ledger website, not through the Mac App Store. The genuine app does not ask users to enter their seed phrases as the fake one did, nor do other legitimate cryptocurrency apps. The stolen funds were routed through the KuCoin crypto exchange, and the hackers used a "mixing" service known as AudiA6, which charges high fees for "laundering" cryptocurrencies.
Three victims lost seven-figure sums, an unusually high amount of money to lose in a fake app scam. ZachXBT, who investigated the fraud and shared information on Telegram, suggested that Apple could face a class-action lawsuit in the future over the lost money.
Apple removed the fake Ledger Live app from the Mac App Store, but it was active for about two weeks. It is unknown how it passed Apple's app review process, and the Cupertino company has not commented on the case.