BleepingComputer reported on 29 October 2026 that a fake cryptocurrency trading app called Padre Terminal, previously available on the Apple App Store for iOS, has been linked by blockchain investigator Iris to the theft of approximately $23,000 from 27 Solana wallets since 25 October 2026. (source: BleepingComputer)

Iris confirmed that one victim was compromised through the App Store app but has not determined how the other wallets were compromised, and says the app drains wallets after users import their private keys into it, according to BleepingComputer.

Iris says the legitimate Padre service, now Terminal by pump.fun, is web-only, so any mobile app impersonating it is malicious. (source: BleepingComputer)

BleepingComputer says the malicious listing (App Store ID 6802739263) has since been removed and returns a 404 error, that the drainer stayed active after the removal with the latest reported theft at 17:06 UTC on 29 October (30 October 01:06 Perth), and that Apple had not responded to its request for comment at publication.

According to Iris, the attacker converted remaining USDC into SOL on 29 October. Iris also flagged four other suspected crypto-brand impersonator apps on the App Store but has not independently confirmed theft for them, BleepingComputer says. (source: BleepingComputer)

Correction (30 Oct 2026): this card's date is now 30 October (Perth). BleepingComputer's feed timestamps its report 15:23 on 29 October US Eastern Daylight Time (UTC-4), which is 3:23 am on 30 October in Perth; the earlier pass read that time as UTC. (source: BleepingComputer)