A trading app called Padre Terminal sat on Apple’s App Store until this week, and the blockchain investigator Iris has tied it to the theft of about $23,000 from 27 Solana wallets. Iris confirmed that one victim was drained through the app itself. How the other 26 wallets were compromised is still unexplained, and the app’s store listing now returns a 404 error.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
According to Iris, the thefts began on October 25 and the drainer kept working after the listing came down. The latest reported theft landed at 17:06 UTC on October 29. Apple had not replied to questions from BleepingComputer about the app by the time the story was published.
How Padre Terminal drained Solana wallets
Iris says the app empties a wallet after a user imports a private key into it, which hands the operator everything that key controls. The investigator suspects the trading interface is served from a remote server, so the app on the phone could look harmless in review, though Iris has not directly observed the screen that triggers the drain. The disguise rests on a real product: Padre was a meme-coin trading platform on Solana that pump.fun later renamed Terminal, and it runs only in a web browser. Iris reasons that any mobile app wearing the Padre name must therefore be malicious.
BleepingComputer’s report, written by Bill Toulas on October 29, found two Padre apps in the store, with IDs 6802739263 and 6717572591. The first was the drainer. The second is probably pump.fun’s official app, live since October 2024, so a buyer searching the store would have met two near-identical listings with no obvious way to tell which belonged to the real project.
The sequence matters for anyone who used the app. Because the drainer was still taking funds after the listing disappeared, removal from the store did not end the exposure for people who had already imported a key, and a private key that has been typed into an app cannot be made secret again. Iris describes the design as simple: the victim supplies the one credential that controls the wallet, and the app forwards it.
Following the money to two Solana addresses
The stolen funds trace to a single Solana address. On October 29 the attacker converted the 4,070 USDC still sitting there into SOL, a swap that removes any chance of the stablecoin issuer Circle freezing the money. The operator then moved 192 SOL to a second wallet. Iris counts a combined 229.66 SOL across the two addresses and says none of it had been cashed out when its update went out, which means recovery is theoretically possible only while the coins stay put.
The tracing is public. Iris laid out its findings in a post on X, and those figures are the basis for the 27-wallet count and the $23,000 total. Because Iris could verify only one victim through the app directly, the link between Padre Terminal and the remaining wallets is an inference from the shared destination address, not a proven chain of events.
Four more suspected impersonators in the store
Padre Terminal is not the only listing under suspicion. Iris identified at least five apps in the App Store that appear to impersonate crypto brands. Axiom Pro: Focus has about 25 reviews since February alleging wallet theft, and one reviewer said it first presented itself as a meme-coin trading platform before turning into a focus app. A review of GMGN AI alleges $2,000 was stolen, a review of HyperTerminal-HyperliquidTools reports $2,020 lost, and Pump Fun Tokens & Analitycs poses as a notes app while a reviewer accuses it of stealing cryptocurrency.
Iris has not independently confirmed theft for those four, and it does not link Padre Terminal to the cluster. It did find a script on a fake Axiom website containing backend addresses tied to Axiom, Aster and GMGN impersonators, which suggests a single operator behind several of them. A script on the GMGN site also blocks visitors from several CIS countries, a pattern that may be an attempt to avoid attention from those regions.
The store has been here before. In March 2024 a fake Leather wallet app appeared and users reported losing assets after connecting their wallets; Apple removed it after about two weeks and barred the publisher from its developer program. An April 2026 episode followed, when a counterfeit Ledger Live app drained roughly $9.5 million from more than 50 users between April 7 and April 13, with security researcher ZachXBT supplying the on-chain analysis.
The size of the haul gives a sense of who was hit. Spread across 27 wallets, $23,000 works out to roughly $850 each, small beside the $9.5 million taken in April and consistent with individual retail traders chasing meme coins rather than large holders. Small individual losses are also the reason such apps can run for days: each victim loses a modest sum, few complain in the store reviews, and the operator moves on before a pattern is visible to Apple.
BleepingComputer’s advice to users is to follow App Store links from a project’s own website, to be wary of apps with only a handful of downloads and reviews, and to question publishers whose names have nothing to do with the project. Apple still owes an explanation of how a drainer passed review, and of what it will do about the five apps Iris flagged.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Tropical Storm Rachel is dumping up to 12 inches on four Mexican states on its way to major hurricane strength
- The FTC says Lens.com doubled the price shoppers saw in Google ads
- Common allergy, bladder and sleep pills tied to sharply higher dementia odds
- NOAA now gives this winter a 75% chance of the strongest El Nino since 1950
