27 Solana wallets were drained and about $23,000 in cryptocurrency stolen after users installed a fake iOS app purporting to be a trading platform called Padre Terminal, blockchain researcher Iris told BleepingComputer.
27 wallets, one malicious App Store listing, and a removed listing
Iris traced the operation to a malicious app that appeared on the Apple App Store and said the drainer had taken roughly $23,000 from 27 Solana wallets since October 25, 2026. The app's listing has since been removed from the App Store and now returns a 404 error, but Iris confirmed at least one victim was compromised directly through that App Store app and has not determined how the other affected wallets were breached.
How the fake Padre Terminal reportedly worked
According to Iris, the fake app presents a trading interface and prompts users to import private keys; the researcher says the app then drains wallets after unsuspecting users import those keys. Iris suspects the trading interface of the fake app is served remotely but has not directly observed the wallet-draining screen. The legitimate service — Padre, now operating as Terminal by pump.fun — is web-only, Iris said, and any mobile apps impersonating it should be treated as malicious.
BleepingComputer found two Padre-related apps on the App Store during its investigation: app ID 6802739263, which Iris confirmed as the drainer, and app ID 6717572591, which is likely pump.fun's official app and has been live since October 2024.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildThe Solana addresses, conversions, and subsequent transfers
Iris traced the stolen funds to the Solana address 3LAgKYoNenWrGWT3U4XWhpgVJWyYkP9wKpiPk8TJT1LN. On October 29 the attacker converted all remaining USDC — reported as 4,070 tokens — into SOL, a step Iris said eliminated the possibility of Circle freezing those funds. The attacker then moved 192 SOL to a new wallet at H84yazsUVCF8eJ6brh27rURMHjdKEVv2BuLS4iuUUQbu. Iris reported the two wallets held a combined total of 229.66 SOL and that, at the time of the researcher's update, no funds had been cashed out. Notably, the drainer remained active after the app's removal, with the latest reported theft occurring at 17:06 UTC on October 29.
Five suspected impersonator apps and signs of a broader campaign
Iris identified at least five suspected crypto-brand impersonators on the App Store: Padre Terminal, Axiom Pro: Focus, GMGN AI, HyperTerminal-HyperliquidTools, and Pump Fun Tokens & Analitycs. Their public listings often show innocuous descriptions, but user reviews sometimes reveal incidents of wallet theft and scams.
- Axiom Pro: Focus had approximately 25 user reviews alleging wallet theft since February; one reviewer said the app presented itself as a meme coin trading platform before changing into a focus application.
- A review tied to GMGN AI alleged $2,000 stolen; a HyperTerminal review reported $2,020 lost. A Pump Fun Tokens & Analitycs listing appeared as a notes application but included a review accusing it of stealing cryptocurrency.
- Iris found a script on a fake Axiom website containing backend addresses associated with impersonators of Axiom, Aster, and GMGN, suggesting a common operator; Iris did not link Padre Terminal to that cluster. A script on the GMGN website also blocks visitors from several CIS countries, which Iris noted could indicate the attackers are attempting to avoid targeting users in those regions.
Iris has not independently confirmed cryptocurrency theft for the four other suspicious apps. BleepingComputer said it contacted Apple about the Padre drainer and the other four apps but had not heard back as of publication.
What this means for iOS users, security teams, and regulators
iOS users: The researchers and reporting reiterate a practical safeguard found in the record — follow App Store links from projects' official websites and avoid installing apps with only a handful of downloads and reviews, or apps published by entities whose names bear no relationship to the project.
Security teams: The episode underscores how quickly attackers can convert on-chain holdings to avoid freezing mechanisms; Iris reported the immediate USDC-to-SOL conversion on October 29. The Blue Report 2026, cited in the source material, also observes that "overall prevention scores can hide what happens after initial access," noting that once attackers use valid credentials, prevention drops sharply.
Regulators and platform operators: App removal does not erase on-chain activity. BleepingComputer cites a March 2024 precedent in which a fake Leather wallet app was removed from the App Store two weeks after appearing and Apple blocked the publisher from its developer program, showing enforcement actions are possible but not instantaneous.
The record drawn by Iris and BleepingComputer is stark: an App Store listing can be a conduit for credential capture and rapid on-chain exfiltration, and even after removal the payouts and transfers can continue. BleepingComputer's report and Iris's traces supply a mapped trail — the questions left are operational: how the app passed review, who published it, and whether further imitators will appear. BleepingComputer has contacted Apple; the company had not responded as of publication.
