Bitcoin scam app listed on Apple App Store, stealing multiple cryptocurrencies from users

IT Home reported on March 31 that according to a report in The Washington Post, a Bitcoin scam app designed to look like a genuine app was accepted by Apple's App Store review team, and eventually caused iPhone user Phillipe Christodoulou to lose 17.1 bitcoins, which were worth more than $600,000 when they were stolen.

Christodoulou wanted to check his bitcoin balance in February and searched Apple’s App Store for “Trezor,” the company that made the hardware device where he stored his cryptocurrency. He saw an app with a Trezor padlock logo and a green background, so he downloaded it and entered his credentials.

Unfortunately, the app was fake and was designed to look like a genuine app to defraud Bitcoin owners. Christodoulou had his total Bitcoin balance stolen and he is furious with Apple. He told The Washington Post that "Apple should not get away with this."

Apple reviews all submitted App Store apps to prevent fraudulent apps from being downloaded by iPhone users, but many fraudulent and plagiarized apps like the fake Trezor app have slipped away, causing significant losses to iPhone users.

Apple said the fake Trezor app made its way onto the App Store through a "bait and switch." It was called Trezor, used Trezor's logo and colors, and claimed to be a "crypto" app that could encrypt iPhone files and store passwords. The developer of the fake app told Apple that it "did not deal with any cryptocurrency." After submitting the fake Trezor app, it transformed itself into a cryptocurrency wallet that Apple could not detect.

Apple spokesman Fred Sainz told The Washington Post that Apple takes swift action when criminals defraud iPhone users.

Our customers’ trust is the foundation on which we founded the App Store, and in the years since, we’ve only deepened that commitment. Study after study has shown that the App Store is the safest marketplace for apps in the world, and we’re constantly working to maintain that standard and further strengthen App Store protections. In the limited cases when criminals defraud our customers, we take swift action against those actors while also preventing similar violations in the future.

Apple declined to comment on how often scam apps are discovered and removed from the App Store, but the company did say that 6,500 apps were removed last year for "hidden or undocumented features."

Apple acknowledged that it has found other cryptocurrency scams on the App Store, but did not provide specific details on the number or whether there have been fake Trezor apps in the past. Trezor does not offer an iOS app at all, and a Trezor spokesperson said it has been notifying Apple and Google about fake Trezor apps "for years."

Apple would not provide The Washington Post with the name of the developer of the fake Trezor app, or whether the developer had released other apps under other names in the App Store, or whether it had given the name to law enforcement officials. Apple said it removed the fake Trezor app and banned the developer after the real Trezor company reported it. Another fake app appeared two days later, which Apple also removed.

Coinbase, a U.K.-based cryptocurrency custody company, said it has received more than 7,000 inquiries about stolen crypto assets since 2019, with fake apps found on Google Play and the App Store being a common complaint. In fact, five people have had their crypto stolen by fake Trezor apps on iOS, with losses totaling $1.6 million.

IT Home learned that data from Sensor Tower showed that the fake Trezor app was downloaded about 1,000 times on the App Store from January 22 to February 3. The 17.1 bitcoins Christodoulou lost are now worth nearly $1 million. Christodoulou said he had not received any news from Apple about the matter.

Another iPhone user who lost $14,000 worth of Ethereum and Bitcoin said an Apple representative told him that the company is not responsible for losses due to the fake Trezor app.