A fake Ledger app sat in Microsoft's own store and drained $768,000

In November 2023, a wallet app called "Ledger Live Web3" was available for download from the official Microsoft Store. It was not made by Ledger. According to BleepingComputer, the counterfeit drained roughly $768,000 in Bitcoin, Ethereum and BNB before Microsoft removed it.

The app impersonated Ledger's genuine hardware-wallet software. It was published under the developer name "Official Dev," carried a single five-star review, and had been visible in the store as early as October 19, 2023. Its description was copied almost word-for-word from the real Apple Store listing.

The mechanics were simple. The app asked users to enter their 24-word recovery phrase — the master key to a crypto wallet — and once that was submitted, attackers emptied the wallets within minutes.

On-chain investigator ZachXBT flagged the scam publicly on November 5, 2023. He initially traced about $588,000 in Bitcoin — roughly 16.8 BTC across 38 inbound transactions that began October 24, most of them after November 2 — to the fraudster, with a secondary wallet holding another ~$180,000 in Ethereum and BNB Smart Chain assets. CoinDesk put the total near $770,000. One victim alone lost $26,500.

Microsoft pulled the listing the same day. The company said it works "to ensure malicious content is identified and taken down quickly," per BleepingComputer. No law-enforcement charges or asset seizures are on record, and the person behind the app was never publicly identified.

The store badge is not a safety check

The lesson is not that Microsoft failed once. It is that mere presence in an official store did the scammer's most important work for them: it borrowed the platform's credibility. A listing looks vetted, so a shopper's guard drops — which is exactly the moment a request for a seed phrase should raise it.

The same weakness has kept beating review since. In April 2026, a fake "Ledger Live" app published under the developer name "Leva Heal Limited" reached Apple's App Store and drained roughly $9.5 million from about 50 victims between April 8 and 11, again through seed-phrase phishing, according to BleepingComputer; ZachXBT tracked the theft, and Apple removed the app and terminated the developer's account. That same month, Kaspersky disclosed 26 counterfeit wallet apps on Apple's App Store — impersonating Ledger, MetaMask, Trust Wallet, Coinbase, TokenPocket, imToken and Bitpie — a campaign active since fall 2025 and tied with moderate confidence to a threat actor Kaspersky calls SparkKitty.

Verify before you install

The common thread across all three cases is a single fatal request: the app asks for your recovery phrase. Real wallets never do. Here is how to check a download before it can cost you anything.

• Get the download link from the vendor's own domain. Type the address yourself (for Ledger, ledger.com) — don't search the store, and don't follow links from emails, ads or DMs.
• Check the developer name on the listing. "Official Dev" and "Leva Heal Limited" are not Ledger; a mismatch is disqualifying, not a rounding error.
• Treat a thin review history or a single glowing rating as a warning, not reassurance. Scam clones are new by definition.
• No legitimate wallet app ever needs your recovery phrase to "sync," "validate" or "restore." A hardware wallet's entire design is that the seed never leaves the device.
• If any app or site asks you to type your 24 words, stop. Assume that wallet is compromised and move the funds using a device you trust.

A store review process filters for some kinds of abuse, but it is not a guarantee of authorship — and the 2026 recurrences show the gap is not closing. The only rule you need to survive this class of scam is one no honest app will ever break: your seed phrase stays with you.

— Sources: [BleepingComputer](https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-in-microsoft-store-steals-768-000-in-crypto/) · [CoinDesk](https://www.coindesk.com/business/2023/11/06/microsoft-listing-fake-ledger-app-leads-to-590k-of-bitcoin-stolen-by-hackers) · [BleepingComputer — Apple App Store](https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto/) · [Kaspersky](https://www.kaspersky.com/about/press-releases/kaspersky-finds-26-fake-crypto-wallet-apps-on-apples-app-store-that-can-drain-digital-assets)