Fake Padre Terminal Slips Past App Store Review; $23K Linked to 27 Stolen Solana Wallets
A counterfeit cryptocurrency trading app posing as Padre Terminal cleared Apple's App Store review and was published for public download. According to BleepingComputer, the app is linked to the theft of roughly $23,000 (about HK$180,000) from around 27 Solana wallets. It has since been pulled and is no longer available.
The dollar figure is modest; the distribution channel is the point. Victims did not sideload an installer from an unknown source or land on a phishing page — they obtained the app from the official store that most users treat as already vetted. App Store review has long been a core assumption of the iOS security model. Once a malicious app completes that process, the assumption needs re-examination.
What Is Known and What Is Not
The report says the fake app is linked to the thefts across 27 Solana wallets. That linkage is not confirmation of who was behind it: the report does not name the security researchers who carried out the analysis, does not explain the technical mechanism of the theft (forged wallet permissions, a phishing-style seed-phrase prompt, or something else), and does not say whether Apple pulled the app, the developer withdrew it, or it was removed at law enforcement's request.
In short, this is an evidence chain with explicit gaps. Writing it up as a confirmed attacker operation would go beyond what the evidence supports — and those gaps, why review passed the app and when the malicious behaviour was finally detected, are precisely the questions the platform needs to answer.
What It Means for Developers
For Hong Kong's mobile app and fintech teams, the incident carries two warnings.
User side: store review is a threshold, not a security guarantee. Even apps distributed through the App Store can ship malicious versions if a developer account is compromised, or if the signing pipeline or a third-party SDK supply chain is tampered with.
Developer side: a passed review means the app was not caught by static checks or behavioural testing. Teams should audit signing credential management, CI/CD pipeline access control, and the trustworthiness of third-party components — the points where a legitimate developer account can become a distribution channel.
Practical Detection Checklist
When downloading any crypto trading or wallet app, work through the following steps:
- Check the developer account: confirm the developer name, team ID and official website match, rather than a similarly named new account.
- Cross-check official links: get the download link from the project's official website or verified social accounts, not from search ads or links forwarded by strangers.
- Treat wallet and seed-phrase prompts as hostile: legitimate trading apps have almost no reason to ask for a mnemonic/seed phrase — terminate immediately on any such prompt.
- Confirm on a hardware wallet: before signing, verify the recipient address and amount on the hardware wallet's screen.
- Treat "official store" as a floor, not a ceiling: store review is a process, not a guarantee.
If you suspect you have been affected by a similar incident, report it to the Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) or the Police's Cyber Security and Technology Crime Bureau. Organisations providing virtual asset services should also handle internal incident response and notification assessments in line with their compliance obligations.
Original report published by BleepingComputer.
假冒 Padre Terminal 混過 App Store 審核上架 27 個被盜 Solana 錢包涉 2.3 萬美元
一款冒充 Padre Terminal 的假冒加密貨幣交易應用程式，成功通過蘋果 App Store 審核並公開提供下載。據 BleepingComputer 報道，該應用與約 27 個 Solana 錢包被盜走約 23,000 美元（約 18 萬港元）相關。該應用其後已被下架，現已無法下載。
金額本身不算龐大，關鍵在於傳播渠道：受害者並非從不明來源側載安裝檔，也不是誤入釣魚網頁——而是從大多數用戶視為「已通過審核」的官方商店取得該應用。App Store 審核一直是 iOS 安全模型的核心假設。一旦惡意應用走完這道流程，這項假設便需要重新檢視。
已知與未知
報道指出，該假冒應用與 27 個 Solana 錢包的盜竊事件存在關聯（linked to）。此關聯並不等同確認幕後主腦身份：報道沒有點名進行分析的保安研究人員，沒有說明盜竊的具體技術機制（例如偽造的錢包授權、釣魚式種子詞提示或其他方式），亦沒有交代應用是蘋果主動下架、開發者自行撤回，還是應執法部門要求移除。
總括而言，這是一條有明確缺口的證據鏈。將其寫成「已確認的攻擊者行動」會超出證據所能支持的範圍——而這些缺口，包括審核流程為何放行該應用、惡意行為何時才被發現，正是平台方最需要回答的問題。
對開發者的意義
對香港的流動應用及金融科技團隊而言，這則事故帶來兩重警示。
用戶端：官方商店審核只是一道門檻，並非安全保證。即使應用經 App Store 分發，一旦開發者帳戶被入侵，或簽署流程、第三方 SDK 供應鏈遭人竄改，一樣可以送審上架惡意版本。
開發端：審核獲放行，意味著應用在靜態檢查及行為測試階段未被攔截。團隊應檢視簽署憑證管理、CI/CD 流水線存取控制，以及第三方元件的可信度——這些正是令合法開發者帳號淪為分發渠道的環節。
實用偵測清單
下載任何加密貨幣交易或錢包應用程式時，建議按以下步驟逐項檢查：
- 核對開發者帳戶：確認開發者名稱、團隊識別碼與官方網站一致，而非名稱相近的新帳戶。
- 交叉比對官方連結：從項目官方網站或已驗證的社交帳戶取得下載連結，不要依賴搜尋廣告或陌生人傳來的連結。
- 把錢包及種子詞提示視為敵意行為：正規交易應用幾乎沒有正當理由要求輸入助記詞／種子詞，任何此類提示都應即時終止。
- 以硬件錢包作最後確認：交易簽名前，在硬件錢包的屏幕上核對收款地址與金額。
- 把「官方商店」視為底線而非天花板：商店審核是流程，不是擔保。
如懷疑自己成為同類事件的受害者，可向香港電腦保安事故協調中心（HKCERT）或警方網絡安全及科技罪案調查部門通報；提供虛擬資產服務的機構，亦應按其合規義務進行內部事故處理及通報評估。
原報道由 BleepingComputer 發布。