Fake crypto app on Apple App Store linked to $23K wallet theft

What it is

Padre Terminal was an iOS app on the Apple App Store (ID 6802739263) that impersonated Padre, a Solana meme-coin trading service now called Terminal by pump.fun. Blockchain investigator Iris linked it to about $23,000 stolen from 27 Solana wallets since 25 October 2026. The legitimate service is web-only, so Iris treats any mobile app using the name as malicious. A second Padre listing (ID 6717572591, live since October 2024) is likely pump.fun's official app, according to BleepingComputer.

How it works

The app asks users to import their wallet private keys, and the wallet is then drained. Iris suspects the trading interface is served remotely, but has not seen the draining screen directly. Only one of the 27 victims is confirmed to have been compromised through the App Store app. How the other 26 were compromised is unknown.

Funds and indicators

• Stolen funds were traced to Solana address 3LAgKYoNenWrGWT3U4XWhpgVJWyYkP9wKpiPk8TJT1LN.
• On 29 October, the attacker swapped all remaining USDC (4,070 tokens) into SOL. Circle can freeze USDC but not SOL, so this closes that option.
• The attacker then moved 192 SOL to H84yazsUVCF8eJ6brh27rURMHjdKEVv2BuLS4iuUUQbu. The two wallets held 229.66 SOL combined, with no cash-out seen at the time of Iris's update.
• The drainer stayed active after the app was pulled. The latest reported theft was at 17:06 UTC on 29 October. The App Store listing now returns a 404.

Other suspected impersonators

Iris lists four more apps: Axiom Pro: Focus, GMGN AI, HyperTerminal-HyperliquidTools, and Pump Fun Tokens & Analitycs. Theft is not independently confirmed for any of them. The evidence is user reviews:

• Axiom Pro: Focus has about 25 reviews alleging theft since February. One reviewer says it posed as a meme-coin trading app before turning into a focus app.
• GMGN AI has a review claiming $2,000 stolen.
• HyperTerminal-HyperliquidTools has a review claiming $2,020 stolen.
• Pump Fun Tokens & Analitycs presents as a notes app and has a review accusing it of stealing crypto.

A script on the fake Axiom website contains backend addresses tied to Axiom, Aster and GMGN impersonators, which suggests a common operator. Padre Terminal is not linked to that cluster. A script on the GMGN website blocks visitors from several CIS countries, which may be an attempt to avoid targeting those regions.

What to do

• Never import a private key or seed phrase into a mobile app. Iris describes the legitimate Padre/Terminal service as web-only.
• Reach App Store listings through links on the project's official website.
• Avoid apps with few downloads and reviews, or whose publisher name has no obvious connection to the project.
• Read the negative reviews. In these cases the reviews exposed the theft while the listing text looked harmless.
• Anyone who imported a key into Padre Terminal should treat that wallet as compromised. This follows from the mechanism but is not stated as advice on the page.

Caveats

BleepingComputer had contacted Apple about all five apps and had no reply at publication. The listings of the four other apps may still be live. In a similar case in March 2024, a fake Leather wallet app was removed after two weeks and its publisher was blocked from Apple's developer program.