Fake 'Padre Terminal' iOS app on Apple App Store drains 27 Solana wallets of ~$23,000
A malicious iOS app named Padre Terminal, distributed through the Apple App Store, has been linked to the theft of roughly $23,000 from 27 Solana wallets since October 25, 2026. Blockchain investigator Iris confirmed at least one victim was compromised via the App Store listing, which drains funds after users import their private keys. The legitimate service — Padre, now Terminal by pump.fun — is web-only, so any mobile app impersonating it is malicious. The fraudulent listing (App Store ID 6802739263) has been removed and now returns a 404, but the drainer infrastructure remained active, with the latest theft recorded at 17:06 UTC on October 29. Iris flagged at least four other suspected crypto-brand impersonators still on the App Store.
Detalhes técnicos
- The app likely serves its trading interface remotely, making static review evasion plausible; the wallet-draining screen was not directly observed.
- Stolen funds were traced to Solana address 3LAgKYoNenWrGWT3U4XWhpgVJWyYkP9wKpiPk8TJT1LN; on October 29 the actor swapped 4,070 USDC to SOL to prevent a Circle freeze, then moved 192 SOL to H84yazsUVCF8eJ6brh27rURMHjdKEVv2BuLS4iuUUQbu. Combined balance: 229.66 SOL, not yet cashed out.
- Other suspect apps: Axiom Pro: Focus (~25 reviews alleging theft since February), GMGN AI ($2,000 reported stolen), HyperTerminal-HyperliquidTools ($2,020 reported stolen), and Pump Fun Tokens & Analitycs (disguised as a notes app).
- A script on a fake Axiom site contained backend addresses tied to Axiom, Aster and GMGN impersonators, suggesting a shared operator; Padre Terminal was not linked to that cluster. A GMGN-impersonating site blocked visitors from several CIS countries.
Remediação
- Never import private keys or seed phrases into mobile apps; use only links to app stores published on the project's official website.
- Avoid apps with few downloads/reviews or publishers unrelated to the project; read negative reviews before installing.
- Monitor and blocklist the identified Solana addresses; rotate any wallet whose keys were entered into these apps.
Linha do tempo
-
Fake 'Padre Terminal' iOS app on Apple App Store drains 27 Solana wallets of ~$23,000
ler a análise desta fonte ocultar
A malicious iOS app named Padre Terminal, distributed through the Apple App Store, has been linked to the theft of roughly $23,000 from 27 Solana wallets since October 25, 2026. Blockchain investigator Iris confirmed at least one victim was compromised via the App Store listing, which drains funds after users import their private keys. The legitimate service — Padre, now Terminal by pump.fun — is web-only, so any mobile app impersonating it is malicious. The fraudulent listing (App Store ID 6802739263) has been removed and now returns a 404, but the drainer infrastructure remained active, with the latest theft recorded at 17:06 UTC on October 29. Iris flagged at least four other suspected crypto-brand impersonators still on the App Store.
Technical Details
- The app likely serves its trading interface remotely, making static review evasion plausible; the wallet-draining screen was not directly observed.
- Stolen funds were traced to Solana address 3LAgKYoNenWrGWT3U4XWhpgVJWyYkP9wKpiPk8TJT1LN; on October 29 the actor swapped 4,070 USDC to SOL to prevent a Circle freeze, then moved 192 SOL to H84yazsUVCF8eJ6brh27rURMHjdKEVv2BuLS4iuUUQbu. Combined balance: 229.66 SOL, not yet cashed out.
- Other suspect apps: Axiom Pro: Focus (~25 reviews alleging theft since February), GMGN AI ($2,000 reported stolen), HyperTerminal-HyperliquidTools ($2,020 reported stolen), and Pump Fun Tokens & Analitycs (disguised as a notes app).
- A script on a fake Axiom site contained backend addresses tied to Axiom, Aster and GMGN impersonators, suggesting a shared operator; Padre Terminal was not linked to that cluster. A GMGN-impersonating site blocked visitors from several CIS countries.
Remediation
- Never import private keys or seed phrases into mobile apps; use only links to app stores published on the project's official website.
- Avoid apps with few downloads/reviews or publishers unrelated to the project; read negative reviews before installing.
- Monitor and blocklist the identified Solana addresses; rotate any wallet whose keys were entered into these apps.