Apple’s App Store has removed a counterfeit Padre Terminal trading app that blockchain investigator Iris identified as the route used to compromise one victim’s cryptocurrency wallet. Iris tracked approximately $23,000 stolen from 27 Solana wallets in the wider operation, but how the other wallets were compromised remains unknown.
In its October 29, 2026 report, BleepingComputer reported Iris’s finding that the fake iOS app drains funds when users import their private keys. The operation’s reported thefts began on October 25, 2026, and continued after the listing disappeared: the latest theft cited occurred at 17:06 UTC on October 29.
The impersonated service, formerly called Padre, was mainly used to trade meme coins on Solana before becoming Terminal by pump.fun. According to Iris, that trading service operates only on the web, making mobile apps claiming to provide it malicious impersonations.
BleepingComputer found two listings using the Padre name during its initial investigation. The distinction matters: app ID 6802739263 was the drainer identified by Iris, while the publication considered ID 6717572591 likely to be pump.fun’s official app, available since October 2024. The malicious listing now produces a 404 error.
Iris told BleepingComputer that the counterfeit app might load its trading interface remotely. That remains a suspicion; the investigator had not directly seen the wallet-draining screen.
Funds moved while thefts continued
Iris traced the stolen cryptocurrency to Solana address 3LAgKYoNenWrGWT3U4XWhpgVJWyYkP9wKpiPk8TJT1LN.
On October 29, according to the investigator, the attacker exchanged all remaining USDC—4,070 tokens—for SOL, removing the possibility of Circle freezing those funds. A subsequent transfer sent 192 SOL to H84yazsUVCF8eJ6brh27rURMHjdKEVv2BuLS4iuUUQbu.
Together, those two wallets contained 229.66 SOL at the time of Iris’s update. The investigator reported no cash-out by that point. The continued thefts also show that removing the App Store listing had not ended the reported operation, although the entry routes for the other compromised wallets remain unresolved.
Other impersonators draw allegations
Iris flagged four additional suspected crypto-brand impersonators: Axiom Pro: Focus, GMGN AI, HyperTerminal-HyperliquidTools, and Pump Fun Tokens & Analitycs. Cryptocurrency theft involving those four apps had not been independently confirmed by Iris.
BleepingComputer described approximately 25 Axiom Pro: Focus reviews alleging wallet theft since February. One reviewer said it had previously appeared to be a meme coin trading platform before becoming a focus app. Separate reviews alleged losses of $2,000 through GMGN AI and $2,020 through HyperTerminal-HyperliquidTools. Pump Fun Tokens & Analitycs appeared as a notes app but also carried a review accusing it of cryptocurrency theft.
According to Iris, a script on a fake Axiom website listed backend addresses associated with Axiom, Aster and GMGN impersonators, suggesting shared operation. Padre Terminal was not linked to that group. A script on the GMGN website also blocked visitors from several CIS countries, which Iris suggested might reflect an effort to avoid users there.
BleepingComputer said Apple had not answered its questions about the five apps by publication. The publication advised users to reach App Store listings through projects’ official websites and to avoid apps with few downloads or reviews, or publishers whose names appear unrelated to the project.
