A fraudulent cryptocurrency trading app under the name Padre Terminal was detected on the Apple App Store, where it was used as a tool to drain users' digital wallets. According to investigations by the security researcher known as Iris, this application led to the theft of nearly $23,000 from 27 wallets connected to the Solana network since October 25, 2026.
Fraud mechanism
The application relies on deceiving users through a trading interface that looks legitimate, and when users import their private keys inside the application, the attackers gain access to the wallets and steal the assets. Researchers tracked the stolen funds to a specific wallet address on the Solana network, where the attackers converted stablecoins (USDC) into SOL currency to avoid any potential freezing measures by coin issuers.
Why this news matters
This incident highlights ongoing vulnerabilities in app review processes on official stores, as applications impersonating popular trading platforms managed to bypass security screening. The danger lies in the fact that attackers use the names of real platforms (such as Terminal by pump.fun) to deceive users, making it difficult for the average user to distinguish between the official and fake applications.
Other suspicious apps
It was not limited to just one application; researchers identified at least five other applications on the Apple store impersonating brands in the cryptocurrency field, such as Axiom Pro and GMGN AI. User reviews for these apps show explicit complaints about asset theft, as some of them change their operational nature from a trading app to a productivity or focus app after being downloaded, in an attempt to mislead review systems.
Security recommendations for users
To protect against these threats, experts advise following the following guidelines:
- Avoid downloading trading apps via direct search in the store; instead, use direct links found exclusively on the official websites of the projects.
- Be cautious of apps that have very few reviews or downloads.
- Verify the developer's identity and ensure its actual connection to the technical project.
- Do not enter private keys or seed phrases into any untrusted or unknown source application.