A fake cryptocurrency trading app called Padre Terminal allegedly stole approximately $23,000 from 27 Solana wallets after being distributed through Apple’s App Store. Blockchain researcher Iris confirmed that at least one victim was compromised through the malicious app, although the method used to access the other wallets remains unclear.
Padre was a cryptocurrency trading platform mainly used to buy and sell meme coins on the Solana blockchain. The service was later renamed Terminal by pump.fun, a platform for creating, buying and selling Solana-based meme coins.
Iris said the legitimate Padre trading service, now operated as pump.fun’s Terminal, is available only through the web. Any mobile app claiming to be the service is therefore malicious, including the fake applications previously listed on the App Store.
According to Iris’s research, the fraudulent app drained wallets after users imported their private keys into it.
At the time of BleepingComputer’s initial investigation, two apps associated with Padre were listed on the App Store. The malicious app had the identifier 6802739263, while app 6717572591 was likely the official pump.fun app, which has been available since October 2024.
Source: BleepingComputer
The malicious Padre Terminal app has since been removed from the App Store, and its listing now returns a 404 error.
Iris told BleepingComputer that the fake app’s trading interface may have been delivered remotely, although he did not directly observe the screen responsible for draining the wallets.
Cryptocurrency traced to Solana wallets
Iris said the operation compromised 27 Solana wallets and stole approximately $23,000 in cryptocurrency starting on October 25, 2026. The stolen funds were traced to Solana address 3LAgKYoNenWrGWT3U4XWhpgVJWyYkP9wKpiPk8TJT1LN.
On October 29, the attacker converted the remaining 4,070 USDC tokens into SOL, according to Iris. That conversion removed the possibility of Circle freezing the USDC funds.
The attacker then transferred 192 SOL to a new wallet at H84yazsUVCF8eJ6brh27rURMHjdKEVv2BuLS4iuUUQbu. Iris said the two wallets held a combined 229.66 SOL, and the funds had not been cashed out when he provided his update.
The cryptocurrency drainer remained active after the app was removed. The most recent reported theft occurred on October 29 at 17:06 UTC.
Other suspicious cryptocurrency apps on the App Store
Iris identified at least five suspected cryptocurrency brand impersonators on the App Store: Padre Terminal, Axiom Pro: Focus, GMGN AI, Hyper Terminal-HyperliquidTools and Pump Fun Tokens & Analycs.
The apps may use harmless-looking descriptions, but user reviews sometimes reveal allegations of wallet theft and other scams.
Axiom Pro: Focus had approximately 25 reviews alleging wallet theft since February. One reviewer claimed the app had initially operated as a meme-coin trading platform before changing into a focused application.
Reviews for GMGN AI reported approximately $2,000 in stolen cryptocurrency, while reviews for HyperTerminal – HyperliquidTools reported about $2,020 in losses.
Another app, Pump Fun Tokens & Analitycs, presented itself as a notes application. However, its reviews explicitly accused the app of stealing cryptocurrency.
Source: BleepingComputer.com
Iris also found scripts on the fake Axiom website containing backend addresses associated with impersonations of Axiom, Aster and GMGN. The overlap suggests that the apps may be operated by the same group, although Padre Terminal was not linked to that cluster.
Scripts on the GMGN website also block visitors from several Commonwealth of Independent States countries, which may indicate that the operators are attempting to avoid targeting users in those regions.
Iris has not independently confirmed cryptocurrency theft linked to the other four suspicious apps.
BleepingComputer contacted Apple about the Padre drainer and the four other suspicious apps that were available on the App Store, but Apple had not responded at the time of publication.
How to avoid fake cryptocurrency apps
A similar incident occurred in March 2024, when a fake Leather cryptocurrency wallet app appeared on the Apple App Store. Multiple users reported losing assets after connecting their wallets. Apple removed the app two weeks later and blocked its publisher from the developer program.
Users should access App Store download links through a cryptocurrency project’s official website whenever possible. They should also avoid apps with very few downloads or reviews and applications published by entities whose names appear unrelated to the project they claim to represent.
Source: www.bleepingcomputer.com