Musician loses retirement savings to fake Ledger app
American musician G. Love lost his retirement fund to a fake Ledger application listed on Apple’s Mac App Store. The Philadelphia-based artist, whose real name is Garrett Dutton, posted on X that all his Bitcoin was gone in an instant after switching to a new computer. On-chain investigator ZachXBT traced 5.92 BTC, worth approximately $424,000 at the time. Everything through nine separate transfers to deposit addresses at the KuCoin exchange. The stolen funds were laundered through the centralised exchange after the attack, which is a common technique for converting cryptocurrency to fiat currency.
G. Love held the Bitcoin for roughly a decade as his long-term retirement savings. The post received over 759,000 views on X and sparked over 360 replies from the cryptocurrency community. Ledger Chairman and CEO Pascal Gauthier responded to the incident by confirming the exploit was the result of a malicious file distributed via compromised websites and package managers.
How the fake Ledger app captured the seed phrase instantly
The fraudulent application was listed on Apple’s Mac App Store under a developer account unaffiliated with Ledger. It presented itself visually and functionally as the legitimate Ledger Live desktop client, the companion software users install to manage their hardware wallets. When G. Love downloaded the app during his device migration to a new Apple computer, it prompted him to enter his 24-word recovery phrase. This request is a major red flag. Why? Genuine Ledger Live never asks users to type their seed phrase into desktop software. The real Ledger device is the only trusted place to enter the recovery phrase, using its own physical screen and buttons. Once G. Love entered his 24-word seed phrase into the fake app, the attackers had full access to the wallet’s private keys and drained the funds immediately.
This attack vector is notable because it exploited trust in Apple’s Mac App Store, a distribution channel most consumers believe is thoroughly vetted. Ledger’s official stance is that users should never enter their seed phrase in any digital form, including on a computer or in an app. Attackers who impersonate Ledger and attempt to steal the 24-word Secret Recovery Phrase are running phishing scams. The incident also raises questions about how the fake app bypassed Apple’s review process, given that the Mac App Store is designed to screen applications before they reach users.
Sources:
