Fake Ledger Live App on macOS Steals Crypto

Cryptos: 21,330
Exchanges: 1,863
Market Cap: $3.46T 1.07%
24h Vol: $450,903,167,210 17.21%
Dominance: BTC: 62.4% ETH: 8.9%
Gas: 3 GWEI

Connect

Crypto News Exploits

Fake Ledger Live App on macOS Steals Crypto—Over 2,800 Sites Compromised

Written by Aaron S.,

Editor-In-Chief

Last Updated: May 23, 2025

Key Takeaways

Hackers are targeting macOS users with fake Ledger Live apps that steal seed phrases and drain crypto wallets;
The malware spreads via Atomic macOS Stealer, found on around 2,800 compromised sites, and swaps the real app for a fake;
Once the fake app is installed, it tricks users into entering seed phrases, giving attackers full access to their funds.

Ace quick missions & earn crypto rewards while gaining real-world Web3 skills. Participate Now ! 🔥

Fake Ledger Live App on macOS Steals Crypto—Over 2,800 Sites Compromised

BITDEGREE IN YOUR SOCIAL FEED

macOS users who use Ledger Live are being targeted by a scam that tricks them into handing over their crypto.

According to a report from Moonlock on May 22, attackers are spreading fake versions of the Ledger Live app that can steal wallet recovery phrases and empty users’ accounts.

The fake app replaces the official Ledger Live after a user’s computer is infected. Once installed, it shows a warning message that looks legitimate and asks the user to enter their seed phrase. If entered, that information is sent straight to the attacker, which allows them to take full control of the wallet.

What is Odysee & LBRY? Is Decentralized YouTube Possible? (ANIMATED)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe - We publish new crypto explainer videos every week!

Moonlock stated that the malware is often spread using a tool called Atomic macOS Stealer. The cybersecurity firm has found the tool on around 2,800 websites that have been compromised. When it infects a system, it collects personal info, passwords, wallet details, and then swaps out the real app for a fake one.

Initially, the fake app could only collect basic wallet data, like notes or password hints, but could not access the funds directly. However, Moonlock explained that attackers have figured out how to collect seed phrases, which allows them to transfer all the money out of the wallet.

Moonlock warns that this is not just about theft—it is about hackers finding new ways to target tools that many crypto users trust.

On May 11, a Ledger Discord moderator account was hacked and posted a phishing link requesting users’ wallet recovery phrases. How did Ledger respond? Read the full story.