Casablanca – A fake app masquerading as Ledger Live on Apple’s App Store has drained nearly $420,000 in Bitcoin from American musician Garrett Dutton, better known as G. Love, in a case that shows even the most security-focused crypto setups can still be undone by phishing and social engineering.
Dutton said he lost 5.9 BTC, savings he had built over almost a decade for retirement, after downloading what appeared to be the official Ledger Live wallet manager onto his new MacBook.
I had a really tough day today I lost my retirement fund in a hack/Scam when I switched my @Ledger over to my new computer and by accident downloaded a malicious ledger app from the @Apple store. All my BTC gone in an instant.
— G. Love (@glove) April 11, 2026
The app looked legitimate enough to pass Apple’s review filters, but it was malicious. Once prompted, he entered his secret recovery phrase, effectively handing attackers full access to the wallet secured by his Ledger hardware device. The funds disappeared within moments.
The incident is a stark reminder that while hardware wallets remain highly secure at the device level, security breaks the moment a user reveals a 12- to 24-word seed phrase. In this case, the hack did not crack the Ledger device itself. Instead, the attackers exploited the weakest point in any system, the human layer.
“I’ve been in the crypto circus since 2017. Today they caught me off guard,” Dutton wrote on X, calling it his “own fault” and warning followers about the growing number of scams.
Blockchain investigator ZachXBT later traced the stolen bitcoin through nine separate transactions, finding that the funds were quickly moved to deposit addresses linked to KuCoin. KuCoin responded with a standard customer service acknowledgment.
The breach also echoes earlier failures by major app marketplaces. In 2023, a fake Ledger app slipped through Microsoft’s store review process and led to nearly $600,000 in losses. The broader problem is getting worse, with FBI data showing crypto-linked complaints tied to $8.6 billion in investment fraud losses in 2025 alone.
In a statement to Morocco World News in response to the incident, Ledger CTO Charles Guillemet said the case reflects a basic but often ignored rule of self-custody.
“Ledger will never ask for your 24 words. If anyone, or any app, is asking for your 24 words, assume something is wrong,” Guillemet said, adding that users should not fully trust the software environment around them, including browsers, desktop apps, or even official app stores.
“The only protection that holds is keeping your private keys on a dedicated hardware device with a secure screen, like a Ledger signer, and never entering your seed phrase into any app or website. Your 24 words are your wallet,” he concluded.
For crypto users, the lesson is brutally simple. The safest device in the world cannot protect funds once the recovery phrase is voluntarily typed into the wrong screen.
Morocco World News is also on X — check out our latest posts now! Get MWN on iOS and Android for instant access to breaking news.
