Fake Crypto Trading App on Apple Store Drains $23K from Solana Wallets
What Happened — A malicious iOS application named Padre Terminal was listed in the Apple App Store and masqueraded as a legitimate Solana‑based trading platform. Between October 25 and October 29 2026 the app prompted users to import their private keys. Once entered, the app silently drained the wallets, stealing roughly $23,000 from 27 different Solana addresses. The malicious code appears to be delivered remotely, allowing the attacker to continue draining wallets even after Apple removed the listing. The stolen funds were moved to a single address and partially converted to SOL, evading immediate freezing by the USDC issuer.
Why It Matters for Trust & Control Assurance — The incident highlights the need for strong credential‑handling controls and rigorous vetting of third‑party mobile applications that request cryptographic secrets.
Who Is Affected — Individual cryptocurrency investors, fintech platforms that integrate wallet import features, and any organization that advises users on mobile crypto tools.
Recommended Actions
- Enforce a policy that private keys are never entered into third‑party apps; use hardware wallets or custodial solutions instead.
- Implement application vetting and code‑signing verification for any mobile app that interacts with corporate or customer wallets.
- Conduct user‑awareness training focused on app impersonation and the risks of importing secrets.
- Monitor blockchain addresses associated with your organization for unauthorized transfers.
Technical Notes
- Attack vector: Malicious mobile app distributed via Apple App Store; remote UI served to users after key import.
- Data types compromised: Private cryptographic keys for Solana wallets; resulting loss of SOL and USDC tokens.
- Status: Malicious app removed from store, but the remote component remains active.
Source: BleepingComputer