Philadelphia Musician G. Love Loses Nearly 6 BTC to Fake Ledger Wallet App on Apple's App Store

Musician G. Love lost nearly 5.92 BTC—described as his entire retirement savings—after downloading a fraudulent Ledger app from the Apple App Store on April 11, 2026. At press time, the stolen bitcoin was valued at $424,175.

How the scam unfolded

Garrett Dutton, frontman of G. Love & Special Sauce, disclosed the loss publicly on X the same day. He said he was setting up his Ledger hardware wallet on a new Apple computer and searched the App Store for the official Ledger Live application. The app he downloaded appeared legitimate, but it was not.

Dutton reported that the fake app prompted him to enter his 24-word seed phrase (also known as a secret recovery phrase). After he typed it in, the attackers drained his bitcoin holdings immediately. He later clarified that only his bitcoin was affected.

On-chain tracing and alleged laundering

Onchain investigator ZachXBT confirmed that approximately 5.92 BTC was stolen. ZachXBT also reported that the funds were allegedly laundered through Kucoin deposit addresses across nine transactions. The transaction records are publicly visible on BTC blockchain explorers.

Ledger’s warning to users

Ledger has repeatedly warned users to download software only from ledger.com and not from app stores, citing the risk of seed phrase theft. The company states it is not present in consumer app stores, and that any Ledger-related app appearing under a different developer name is fraudulent.

Broader pattern targeting macOS users

The incident aligns with a previously documented pattern targeting macOS users. In 2025, cybersecurity firm Moonlock reported malware designed to replace legitimate Ledger Live installations on macOS and prompt users to enter their seed phrases. Moonlock also noted that searches for “Ledger” in the Mac App Store have returned impostor apps listed by third-party sellers rather than the real developer, Ledger SAS.

Market and self-custody implications

The mechanics of the attack are described as straightforward: a user installs an impostor app from an app store and enters a seed phrase when the app requests it. Once the seed phrase is exposed, attackers can access every wallet derived from it. Ledger hardware wallets are not designed to protect against theft if the seed phrase is entered into an app, website, or computer.

Self-custody guidance emphasized in the reporting is that the seed phrase should never leave the physical Ledger device and should only be entered directly on the device during initial setup.

Reaction and follow-up

Public reaction on X was mixed, with some users expressing sympathy and others questioning the plausibility of the account, including concerns about how Ledger hardware wallets require physical confirmation on the device. Dutton said he was socially engineered into entering the seed phrase voluntarily, which he described as the scam’s attack vector.

As of April 12, 2026, mainstream news outlets had not yet covered the story. Bitcoin.com News was reported as the first to do so. Dutton indicated he would move forward and expressed gratitude for his health, family, and music career, including a recent performance at Tortuga Fest. No legal action has been announced.