There’s a specific kind of anger that comes from watching Apple leave a blatant scam live in its App Store for months while you do everything right and still lose your money.
Reporting a scam through official channels. Waiting patiently for the platform responsible to act. Watching that platform do nothing while the fraud sits there, live, in a store carrying Apple’s own name.
That’s not a hypothetical. It’s exactly what happened to the team behind one of DeFi’s most trusted analytics platforms, and it’s a pattern I’ve now traced across multiple major crypto brands with the same maddening shape every time.
Months Of Warnings, Then A Theft Apple Finally Listened To
DeFiLlama founder 0xngmi laid out the timeline plainly: the team had spent months reporting a fake DeFiLlama app on the Apple App Store for trademark infringement and impersonation, and Apple simply did not remove it. You can follow his ongoing account of the platform and its incidents directly on his official account here:
What happened next is the part that genuinely stopped me. After months of formal reports going nowhere, the DeFiLlama team deposited a small amount of funds into a test wallet and used the fake app themselves, entering the seed phrase exactly as the app instructed. The funds were stolen immediately. Only after they submitted that theft as hard evidence did Apple finally remove the app, and it happened within days.
I think that sequence says something uncomfortable on its own: a legitimate team’s trademark complaint, repeated for months, apparently carried less weight with Apple than a single, concrete instance of financial loss. 0xngmi added that the same attackers behind the fake DeFiLlama app had also built similar fake apps targeting multiple other major crypto brands, meaning this wasn’t a one-off scheme built around a single target, it was a repeatable operation being run against the industry at scale.
Rabby Wallet Faced The Same Wall Of Silence
DeFiLlama’s experience is an outlier, Rabby Wallet’s own story from earlier this year shows the same pattern playing out almost beat for beat. In February 2024, a fake app calling itself “Rabby Wallet & Crypto Solution” appeared on the App Store while the real Rabby mobile app, built by DeBank, was still sitting in Apple’s own review queue. The fake app got approved and listed before the legitimate one ever did.
Rabby’s team posted directly to warn users, writing plainly that a fake iOS app had resurfaced, that their real app remained under review, and pointing users to their official website as the only safe download source. You can read that official warning directly here:
Despite that warning, and despite a growing thread of user complaints on Reddit and Apple’s own community forums, the fake app stayed live for at least four to five days while reports kept piling up. Blockchain analysis later traced approximately $1.6 million in stolen funds to the operation, with individual victims reporting losses ranging from a few thousand dollars up to roughly $40,000 in a single case.
The Slow Response Isn’t A Coincidence, It’s A Pattern
I think what connects these cases is worth naming directly: neither team was caught off guard. Both had clear evidence, both reported through official channels, and both watched their warnings sit largely unaddressed until real financial damage had already occurred. That’s not two isolated moderation failures, it’s the same structural gap showing up twice.
Security research backs up just how systemic this has become. Kaspersky’s own threat research team documented an extended campaign of fake crypto wallet clones circulating specifically through the App Store and Google Play, tricking users into surrendering recovery phrases before attackers reconstructed their wallets and laundered the stolen assets across multiple blockchain networks. You can read Kaspersky’s full technical breakdown directly here: Phishing crypto-wallet clones in the App Store and other attacks on iOS and macOS crypto owners. This isn’t a story about one bad actor slipping through once, it’s a story about a review process that keeps letting the same category of scam back in, repeatedly, across different brands and different months.
What Users Actually Lost While Waiting For Action
I think it’s worth sitting with what these delays actually cost real people, not just the brands being impersonated. In the Rabby case, one victim described losing 24,000 dollars after downloading the fake app because Rabby’s own website hadn’t yet been updated to clarify the real app was still under review, leaving them to reasonably assume the App Store listing was legitimate. Another reported losing roughly 5,000 dollars the same morning, filing a support case with Apple in the hope of reimbursement despite the app having already been reported multiple times before their loss occurred.
That’s the part of this story that I think gets lost in the broader “app store security” framing. These aren’t abstract statistics. They’re people who trusted a platform specifically because it’s Apple’s own store, who followed the reasonable instinct to search for an app rather than dig for a direct download link, and who paid for that reasonable choice with real, unrecoverable losses while their reports sat in a queue.
Why This Keeps Happening, And What It Says About App Store Trust
I don’t think the honest takeaway here is that Apple’s review process is incompetent across the board, it clearly catches an enormous volume of malicious software daily. But these repeated cases suggest something more specific: trademark and impersonation complaints from crypto projects, on their own, don’t seem to trigger the same urgency as a confirmed report of active financial theft. That’s a genuinely dangerous gap for an industry where impersonation is the entire attack vector, and where by the time theft is confirmed, the damage is already done and irreversible.
For anyone using crypto apps day to day, I think the practical lesson from both of these cases is uncomfortable but necessary: App Store approval alone isn’t proof of legitimacy anymore, however much it should be. Verifying an app’s developer name against the project’s own official website before ever entering a seed phrase isn’t paranoia at this point, it’s the only real safeguard available while platforms like Apple continue treating documented impersonation reports as lower priority than they clearly deserve to be.
Disclosure: This is not trading or investment advice. Always do your research before buying any cryptocurrency or investing in any services.
Follow us on Twitter @themerklehash to stay updated with the latest Crypto, NFT, AI, Cybersecurity, and Metaverse news!
