26 Fake Crypto Wallets Discovered in the App Store

The apps use phishing and malicious installs to steal user funds.

Kaspersky finds 26 fake crypto wallets in the App Store

23.04.2026 - 10:45

222

3 min

Key points:

Kaspersky identified 26 fake crypto wallets in the App Store posing as well-known services.
The apps redirect users to phishing pages and install malicious wallets.

Kaspersky researchers have uncovered 26 fake crypto wallet apps in the Apple App Store. All of them mimic well-known services and are designed to steal users’ funds.

The apps copy the names and interfaces of popular wallets, including MetaMask, Trust Wallet, Ledger, and Coinbase. Once opened, they redirect users to a phishing page that prompts them to install an “update.” In reality, this is a malicious app that can access crypto assets.

How the Scheme Works

According to Kaspersky, the campaign has been active since at least fall 2025. Researchers have linked it to SparkKitty, a previously identified strain of iOS malware.

Many of the apps were distributed through the Chinese version of the App Store, where official versions of some wallets are unavailable. However, the campaign is not region-specific—users worldwide could be affected. Kaspersky has already reported the apps to Apple.

Ledger’s reputation under fire: wallet users lose nearly $10 million

The stolen funds were laundered through KuCoin using more than 150 one-time addresses. The incident comes amid a Ledger data breach, further deepening the trust crisis surrounding hardware wallets.

To pass App Store review, attackers include basic features like calculators or mini-games to make the apps appear legitimate. After installation, users are guided through a series of steps that ultimately lead to downloading a malicious wallet.

The scheme relies on Apple’s enterprise tools to install apps outside the App Store. Users are prompted to install a developer profile—this is the point where the device becomes compromised.

Once installed, the malicious wallet mimics the interface of the legitimate service and can access both hot and cold wallets.

Experts warn that even if an app appears safe, it may be part of a broader attack chain. The scheme relies on user inattention and trust in the iOS ecosystem.

Author: