Microsoft App Store's Fake Ledger Live App Leads To $590K Bitcoin Stolen By Hackers

Ledger Live is an app that allows ledger hardware wallet users to access and send their assets. A fake app named, “Ledger Live Web3” on the Microsoft Corp MSFT App Store led users to assume that they were installing the actual Ledger Live interface for offline cryptocurrency storage.

What Happened: Cryptocurrency detective ZachXBT said that the scammer received about 16.8 Bitcoin BTC/USD, or $588,000, in 38 transactions using a particular wallet address, CoinDesk reported. Around $115,200 has been removed from the scammer's wallet in two transactions, leaving a balance of $473,800 or 13.5 BTC.

Community Alert: There is currently a fake @Ledger Live app on the official @Microsoft App Store which was resulted in 16.8+ BTC ($588K) stolen

Scammer address
bc1qg05gw43elzqxqnll8vs8x47ukkhudwyncxy64q pic.twitter.com/rOZ0ZWRWbn
— ZachXBT (@zachxbt) November 5, 2023

The initial transaction happened on Oct. 24 for $5,210 BTC. The transactions have been occurring since Nov. 2, including the largest transfer of $81,200 on Nov. 4.

An additional $180,000 had also been stolen from the Ethereum blockchain and BNB Smart Chain (BSC), leading to a total theft of $770,000.

This news comes on the heels of Benzinga’s Future Of Digital Assets Event in New York scheduled on Nov.14. Attend and learn more about how fake apps and scams are making their way into customers’ accounts and stealing funds. The gathering is seen as pivotal for the digital assets community. The event will spotlight the latest trends, innovations, and challenges in the digital asset realm.

Background

The fake Ledger Live Web3 application was visible in Microsoft’s app store as early as Oct. 19 and has now been removed, Cointelegraph reported.

This is not the first time a fake app managed to sneak not Microsoft’s app store. In December and March, Ledger’s support account informed its users about a fake Ledger Live app.

Meanwhile, last week saw a crypto thief stealing $4.4 million worth of crypto in a single day as the toll from the LastPass breach continued to escalate. LastPass, a cloud-based storage service, is a platform that stores and encrypts password information for users.

Industry titans BlackRock, DTCC, OCC, State Street, Société Générale, Hedera, Citi, BMO, Northern Trust, Citibank, Amazon, S&P Global, Google, Invesco, and Moody’s will join our November 13 Fintech Deal Day and November 14 Future of Digital Assets. Secure a spot here to join them.