A fake trading app on Apple's App Store has been tied to about $23,000 stolen from 27 Solana wallets. The trick was asking users to type in a secret key.
A fake crypto trading app called Padre Terminal sat on Apple's App Store and has been linked to the theft of about $23,000 from 27 Solana wallets. Solana is a popular crypto network. The app has since been removed, but the thief was still active after that.
Padre was a trading service mostly used to buy and sell meme coins on Solana. It was later renamed Terminal by pump.fun. Blockchain investigator Iris says the real service works only on the web, so any mobile app posing as it is malicious. That includes the one on the App Store.
The app worked by asking users to import a private key. A private key is the secret code that gives full control of a crypto wallet. Whoever holds it can move the money. Iris says the app drains wallets once users hand it over.
Iris says the operation has emptied 27 wallets since October 25, 2026. The latest reported theft was at 17:06 UTC on October 29. Iris has confirmed that one victim was hit through the App Store app. How the other wallets were compromised is not yet known.
On October 29, the attacker swapped all remaining USDC, about 4,070 tokens, into SOL. That removes the chance that the company behind USDC could freeze those funds. Two wallets tied to the thief held a combined 229.66 SOL, and none had been cashed out at the time of Iris's update.
Iris flagged at least five suspected crypto-brand impersonators on the App Store, including Padre Terminal. The other four are:
Iris has not independently confirmed theft for these four. The reviews are allegations. BleepingComputer contacted Apple about all five apps and had not heard back at publication.
The main risk is for iPhone users who trade meme coins or use Solana wallets, especially anyone who installed an app copying Padre, Terminal, Axiom, GMGN, Hyperliquid or Pump Fun. Anyone who has never typed a wallet key into an app is not at risk from this scheme. The same goes for people who do not use crypto at all.
These listings often look harmless. Descriptions read fine, and the warning signs sit in the user reviews. One reviewer said the Axiom Pro app first presented itself as a meme coin trading platform and later turned into a focus app. A notes app that asks about crypto is another red flag.
This has happened before. In March 2024, a fake Leather wallet app appeared on the App Store and users reported losing assets. Apple removed it about two weeks later. A listing in the App Store is not proof that an app is safe.
The alert box above lists the steps to take, including what to do if you already used one of these apps.
Never type a crypto wallet's private key into any app, and do not assume an App Store listing means an app is safe.
A viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you callThe Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone calls
