Apple Has a Fake Ledger App Problem After Musician Loses a Decade of Bitcoin Savings

Philadelphia musician Garrett Dutton, known professionally as G. Love of G. Love & Special Sauce, lost his entire Bitcoin retirement fund on 11 April 2026 after downloading a fraudulent application from Apple's Mac App Store. The stolen stash, worth approximately £315,514 ($424,175) at the time, represented nearly a decade of accumulated savings. Dutton disclosed the loss publicly on X the same day, writing: 'I had a really tough day today I lost my retirement fund in a hack/scam when I switched my Ledger over to my new computer.'

According to Dutton's public statements on X, he searched the Apple App Store for the official Ledger software while reconfiguring his hardware wallet on a new Mac. He downloaded what appeared to be a legitimate Ledger Wallet app. The application, however, was not developed by Ledger SAS, the company behind the popular hardware wallets. Instead, it was listed under a third-party developer — and it had already cleared Apple's review process.

'Today They Caught Me Off Guard'

The mechanics of the scam were straightforward and devastating. The fake app prompted Dutton to enter his 24-word seed phrase. Once he typed it in, the attackers drained his Bitcoin holdings almost instantly. When some users on X questioned the plausibility of the account — noting that Ledger devices typically require physical confirmation for outgoing transactions — Dutton clarified that he had been socially engineered into entering the phrase voluntarily, which bypasses the hardware wallet's protections entirely. 'I been in the crypto circus since 2017. Today they caught me off guard,' he wrote.

On-chain investigator ZachXBT subsequently confirmed the laundering path, tracing the stolen funds through nine transactions to KuCoin deposit addresses. The transaction records remain publicly visible on the Bitcoin blockchain. ZachXBT expressed little optimism about recovery, accusing KuCoin of performing compliance only when convenient and pointing to its loss of an EU MiCA licence in February 2026 — just three months after obtaining it from Austria's financial regulator.

Apple's Review Process in the Dock

The incident has reignited serious questions about how a counterfeit financial application passed through Apple's notoriously strict vetting process. This is not the first time a counterfeit Ledger application has cleared an ostensibly supervised app store review. In 2023, a fake Ledger Live app listed on Microsoft's store enabled attackers to steal nearly £446,326 ($600,000) in Bitcoin from multiple victims before the listing was removed.

ZachXBT went further than simply tracing the funds. In a follow-up post, he shared a screenshot from urlscan.io showing an HTTP 400 error with the message 'Scan prevented... The owner of this infrastructure has requested us to prevent scanning for it,' adding: 'It seems Apple does not want people documenting the fact they allow fake apps on the App Store.' As of 14 April, Apple had not issued any public response to the theft, to Dutton's appeal, or to ZachXBT's allegation.

Ledger has warned users to download software only from ledger.com, never from app stores, to prevent seed phrase theft. The company has consistently stated that it does not distribute Ledger Live through any consumer app store, and that any app appearing under a name other than Ledger SAS should be treated as fraudulent.

A Pattern Bigger Than One Incident

Impersonation scams surged roughly 1,400% year-over-year in 2025, according to Chainalysis, while personal wallet theft accounted for roughly £530 million ($713 million) in losses across 158,000 incidents. According to the FBI, Americans lost more than £8.18 billion ($11 billion) to crypto-related fraud in 2025 alone, up from £6.69 billion ($9 billion) the year prior — and seed-phrase phishing through impersonated wallet software remains one of the highest-yielding attack categories.

Dutton has since said he will move forward, expressing gratitude for his health, family, and music career. No legal action has been announced. Apple has not issued a public statement regarding the fraudulent listing or Dutton's appeal.

For the millions of users who trust the App Store as a safe harbour for financial software, this case is a reminder that platform trust alone is not a sufficient safeguard. Until Apple responds publicly and removes counterfeit crypto applications with demonstrated urgency, Ledger users — and crypto holders more broadly — remain exposed.