Blockchain investigator ZachXBT has linked a fake Ledger Live app to over 50 victims, who have lost a total of $9.5 million worth of crypto between them.
He traced stolen funds to KuCoin deposit addresses and called out the crypto exchange via Telegram and X.
Over 150 addresses tied to a known money laundering service were reportedly used to deposit stolen funds to the exchange.
App Store honeypot
Garrett Dutton of the band G. Love & Special Sauce initially drew attention to the fake wallet app, previously available on Apple’s App Store, when he took to X on Saturday to lament losing his retirement fund “in an instant.”
Dutton’s thread explains that he lost 5.9 bitcoin (worth approximately $440,000) after being “tricked” into entering his seed phrase into the app.
I had a really tough day today I lost my retirement fund in a hack/Scam when I switched my @Ledger over to my new computer and by accident downloaded a malicious ledger app from the @Apple store. All my $BTC gone in an instant.
— G. Love (@glove) April 11, 2026
Around 12 hours after Dutton’s post, ZachXBT flagged nine transaction IDs which the sleuth claims show Dutton’s $BTC being “laundered” via crypto exchange KuCoin.
Two days later, ZachXBT published a follow-up community alert to his Telegram group ‘Investigations.’ It linked the fake app to “$9.5M stolen from 50+ suspected victims between April 7–13 across Bitcoin, EVM, Tron, Solana, & Ripple.”
The top three victims reportedly lost a combined total of $7.25 million in various cryptocurrencies.
KuCoin under fire
ZachXBT’s Telegram post also tied over 150 KuCoin deposit addresses to money laundering service AudiA6.
He also called out KuCoin on X, where he highlighted both these fake Ledger Live app-linked thefts and the recent Bitcoin Depot loss, accusing the exchange of allowing money launderers to “operate freely.”
C) Want to explain to the community why Kucoin allowed a threat actor to launder $9.5M+ tied to a fake Ledger app via 150+ Kucoin deposit addresses over the past week?
A few days before that another threat actor laundered $3.5M+ from the Bitcoin Depot incident via 25+ Kucoin… pic.twitter.com/vo7jb1rdwu
— ZachXBT (@zachxbt) April 14, 2026
The exchange eventually replied to ZachXBT’s list of theft addresses in the Dutton case, 48 hours after it was posted. Other on-chain investigators have flagged addresses allegedly linked to scams who have deposited significant sums to KuCoin over recent weeks.
Just over two years ago, KuCoin and two of its founders were charged with flouting U.S. anti-money laundering laws.
Protos reached out to KuCoin, but it did not respond immediately, we will update this piece if we hear back.