Get the latest crypto news, updates, and reports by subscribing to our free newsletter.
Giấy phép số 4978/GP-TTĐT do Sở Thông tin và Truyền thông Hà Nội cấp ngày 14 tháng 10 năm 2019 / Giấy phép SĐ, BS GP ICP số 2107/GP-TTĐT do Sở TTTT Hà Nội cấp ngày 13/7/2022.
© 2026 Index.vn
Musician G. Love lost nearly 5.92 BTC—described as his entire retirement savings—after downloading a fraudulent Ledger app from the Apple App Store on April 11, 2026. At press time, the stolen bitcoin was valued at $424,175.
Garrett Dutton, frontman of G. Love & Special Sauce, disclosed the loss publicly on X the same day. He said he was setting up his Ledger hardware wallet on a new Apple computer and searched the App Store for the official Ledger Live application. The app he downloaded appeared legitimate, but it was not.
Dutton reported that the fake app prompted him to enter his 24-word seed phrase (also known as a secret recovery phrase). After he typed it in, the attackers drained his bitcoin holdings immediately. He later clarified that only his bitcoin was affected.
Onchain investigator ZachXBT confirmed that approximately 5.92 BTC was stolen. ZachXBT also reported that the funds were allegedly laundered through Kucoin deposit addresses across nine transactions. The transaction records are publicly visible on BTC blockchain explorers.
Ledger has repeatedly warned users to download software only from ledger.com and not from app stores, citing the risk of seed phrase theft. The company states it is not present in consumer app stores, and that any Ledger-related app appearing under a different developer name is fraudulent.
The incident aligns with a previously documented pattern targeting macOS users. In 2025, cybersecurity firm Moonlock reported malware designed to replace legitimate Ledger Live installations on macOS and prompt users to enter their seed phrases. Moonlock also noted that searches for “Ledger” in the Mac App Store have returned impostor apps listed by third-party sellers rather than the real developer, Ledger SAS.
The mechanics of the attack are described as straightforward: a user installs an impostor app from an app store and enters a seed phrase when the app requests it. Once the seed phrase is exposed, attackers can access every wallet derived from it. Ledger hardware wallets are not designed to protect against theft if the seed phrase is entered into an app, website, or computer.
Self-custody guidance emphasized in the reporting is that the seed phrase should never leave the physical Ledger device and should only be entered directly on the device during initial setup.
Public reaction on X was mixed, with some users expressing sympathy and others questioning the plausibility of the account, including concerns about how Ledger hardware wallets require physical confirmation on the device. Dutton said he was socially engineered into entering the seed phrase voluntarily, which he described as the scam’s attack vector.
As of April 12, 2026, mainstream news outlets had not yet covered the story. Bitcoin.com News was reported as the first to do so. Dutton indicated he would move forward and expressed gratitude for his health, family, and music career, including a recent performance at Tortuga Fest. No legal action has been announced.

Premium gym chains are entering a “golden era” that is ending or already in decline, as rising operating costs collide with shifting consumer preferences toward more flexible, community-based ways to exercise. Long-term memberships are shrinking, margins are pressured by higher rents and facility expenses, and competition from smaller, more personalized…