A fraudulent cryptocurrency trading application named Padre Terminal, which was previously distributed through the Apple App Store for iOS, has been connected to the theft of roughly $23,000 from 27 Solana wallets. Blockchain investigator Iris has verified that at least one victim fell victim to the malicious App Store application, though the compromise method for the remaining affected wallets remains unclear.
The malicious application functioned by draining cryptocurrency wallets once users entered their private keys into it. Padre operated as a cryptocurrency trading service focused on trading meme coins on Solana. The legitimate Padre service was subsequently rebranded as Terminal by pump.fun, a platform dedicated to the creation and trading of cryptocurrency meme coins on the Solana blockchain.
According to Iris, the legitimate Padre trading service, now known as Terminal by pump.fun, operates exclusively as a web platform, meaning any mobile applications claiming to be Padre are fraudulent. During BleepingComputer's investigation, two Padre applications were discovered on the App Store (ID 6802739263 and ID 6717572591). The first was the confirmed drainer application identified by Iris, while the second, available since October 2024, is believed to be pump.fun's legitimate offering.
The fraudulent Padre Terminal application has been taken down from the App Store, with its page now displaying a 404 error. Iris suspects the fake application's trading interface was delivered from a remote server but has not directly observed the wallet-draining mechanism in operation.
The theft operation has targeted 27 Solana wallets beginning October 25, 2026, with approximately $23,000 in cryptocurrency stolen. The stolen funds were sent to the Solana address 3LAgKYoNenWrGWT3U4XWhpgVJWyYkP9wKpiPk8TJT1LN. Iris reports that the attacker converted the remaining 4,070 USDC tokens to SOL on October 29, preventing Circle from freezing those assets.
The attacker subsequently moved 192 SOL to a separate wallet (H84yazsUVCF8eJ6brh27rURMHjdKEVv2BuLS4iuUUQbu). The two wallets held a combined 229.66 SOL at the time of Iris's report, with no funds withdrawn. The drainer continued operating even after the app's removal, with the final documented theft occurring at 17:06 UTC on October 29.
Additional suspicious applications discovered
Iris has identified at least five suspected cryptocurrency-brand impersonators currently available on the App Store: Padre Terminal, Axiom Pro: Focus, GMGN AI, HyperTerminal-HyperliquidTools, and Pump Fun Tokens & Analitycs. While their official descriptions appear innocuous, user reviews frequently expose their malicious intent, with numerous accounts of wallet theft and fraud.
The Axiom Pro: Focus application accumulated approximately 25 user reviews since February alleging wallet theft. One user reported that the application initially presented itself as a meme coin trading platform before switching to a focus application. The GMGN AI application had a review claiming $2,000 was stolen, while HyperTerminal-HyperliquidTools had a review reporting $2,020 in losses.
Pump Fun Tokens & Analitycs was marketed as a notes application but contained a review directly accusing it of cryptocurrency theft. Iris discovered a script on the fraudulent Axiom website containing backend addresses linked to impersonators of Axiom, Aster, and GMGN, suggesting a single operator behind these applications. However, Padre Terminal was not connected to this cluster.
A script found on the GMGN website restricts access from multiple CIS countries, which may indicate the attackers are deliberately avoiding targeting users in those regions. Iris has not independently verified cryptocurrency theft for the four other suspicious applications.
BleepingComputer reached out to Apple regarding both the Padre drainer and the four additional suspicious applications on the App Store but received no response by the time of publication.
Prior incidents and user protection
In March 2024, a counterfeit Leather cryptocurrency wallet application appeared on the Apple App Store, leading multiple users to report asset losses after connecting their wallets. Apple removed the application after two weeks and revoked the publisher's developer program access.
Users should download applications exclusively through links provided on official project websites and exercise caution with applications that have minimal downloads and reviews or are published by developers with names unrelated to the project.