A malicious iOS application impersonating cryptocurrency trading platform Padre Terminal resulted in the theft of approximately $23,000 from 27 Solana wallets before Apple removed the listing. Blockchain investigator Iris confirmed the fake app drains funds when users import private keys. Although Apple took down the Padre drainer, several other suspicious crypto impersonator apps remain on the App Store despite user reviews alleging thousands of dollars in stolen assets.
Padre Terminal theft scope and victims
- ▪A fake cryptocurrency trading app named Padre Terminal, previously available on the Apple App Store, was linked to the theft of approximately $23,000 from 27 Solana wallets between October 25 and October 29, 2026.
- ▪Blockchain investigator Iris confirmed one victim was compromised directly through the fake Padre Terminal iOS app, but had not determined how the other 26 affected Solana wallets were compromised.
Operation of the fake Padre app
- ▪Blockchain investigator Iris suspects the malicious trading interface of the fake Padre Terminal iOS app is served remotely to evade detection, though the investigator has not directly observed the wallet-draining screen.
- ▪Blockchain investigator Iris reported that the legitimate Padre trading platform, renamed Terminal by pump.fun, operates exclusively as a web service and maintains no legitimate iOS app under the Padre name.
- ▪The fake Padre Terminal app drains user cryptocurrency wallets after unsuspecting victims import their private keys into the mobile application.
Tracing stolen Solana funds
- ▪The attacker transferred 192 SOL from the primary stolen funds wallet to a secondary Solana wallet H84yazsUVCF8eJ6brh27rURMHjdKEVv2BuLS4iuUUQbu, bringing their combined holdings to 229.66 SOL with zero funds cashed out.
- ▪Stolen cryptocurrency from the Padre Terminal drainer was traced to Solana address 3LAgKYoNenWrGWT3U4XWhpgVJWyYkP9wKpiPk8TJT1LN before the attacker converted 4,070 USDC into SOL on October 29, 2026.
Padre apps on the App Store
- ▪BleepingComputer identified two Padre apps on the Apple App Store during its initial investigation, including an official pump.fun app live since October 2024.
- ▪Apple removed the malicious Padre Terminal app listing (ID 6802739263) from the App Store, but did not respond to BleepingComputer's inquiry regarding Padre Terminal and four other reported fake crypto apps.
Other fake crypto apps identified
- ▪User reviews for the fake Axiom Pro: Focus app on the Apple App Store alleged wallet theft dating back to February, with one reviewer noting it transformed from a meme coin trading interface into a focus app.
- ▪Blockchain investigator Iris identified at least five suspected crypto-brand impersonator apps on the Apple App Store, including Padre Terminal, Axiom Pro: Focus, GMGN AI, HyperTerminal-HyperliquidTools, and Pump Fun Tokens & Analitycs.
- ▪App Store user reviews for the fake GMGN AI app alleged $2,000 in stolen cryptocurrency, while reviews for HyperTerminal-HyperliquidTools reported $2,020 in stolen funds.
- ▪A script discovered on a fake Axiom website contained backend addresses associated with Axiom, Aster, and GMGN impersonator apps, suggesting a common threat operator.
Fake Leather wallet app
- ▪Multiple users reported losing their assets after connecting their cryptocurrency wallets to the fake Leather app on the Apple App Store in March 2024.
- ▪In March 2024, a fake Leather cryptocurrency wallet drainer app remained on the Apple App Store for two weeks before Apple removed the application and banned its developer account.
Story comments
Loading comments…