TL;DR
- DefiLlama’s founder let a fake DefiLlama app drain a small wallet after months of unsuccessful reports to Apple, and the listing was removed within days.
- The impersonating app asked users for their seed phrase, giving its operators full control over any wallet entered into the app.
- The case highlights how crypto app impersonation can survive storefront review and why users should verify the developer before trusting a wallet-related app.
For months, DefiLlama flagged a fake version of its app to Apple over trademark violations and impersonation. But Apple left the listing up. So the analytics platform’s pseudonymous founder, known as 0xngmi, funded a small wallet, installed the impersonating app himself, and let it steal the money.
0xngmi disclosed the episode in a series of posts on X on August 15. The fake app was a simple clone. It asked users to enter their seed phrase, the string of words that grants full control over the related crypto wallet. No legitimate analytics app needs that phrase.
0xngmi said the operators behind the app had verified their Apple developer account using a defunct, decades-old shoe business. The same group had targeted other major crypto brands with similar impersonation attempts.
The reporting timeline
According to 0xngmi, DefiLlama’s team reported the fake app to Apple’s abuse and trademark channels repeatedly, describing the impersonation and the brand infringement in detail. Despite the continuous effort, the listing stayed up for months.
So, the team changed tactics. They loaded a wallet with a small amount of crypto, installed the app, and went through its flow, entering the seed phrase where it was requested. As expected, the funds disappeared. Instead of simply filing another complaint, 0xngmi now sent evidence to Apple that the app was indeed malicious. Apple removed the app within days of receiving it.
>>> Read more: SafePal Data Breach Exposes 39,798 Customer Orders
Why DefiLlama waited to ship its own app
The impersonation problem was not isolated to one listing, and it delayed DefiLlama’s own mobile app launch. 0xngmi said the team held off releasing its official app until the most dangerous fake versions were cleared from the App Store. They wanted to prevent new users from downloading the wrong one during launch week.
DefiLlama’s official app went live afterward. Apple’s listing names DefiLlama as the developer and DEFILLAMA LIMITED as the provider, matching the entity behind defillama.com. Version 1.0 shipped June 5, with updates following through August 8. Google Play lists the same developer and links to the same site. Both stores’ descriptions are explicit that the app is for research, not custody. It does not hold funds or execute trades.
>>> Read more: Fake Ledger App Steals $9.5M via Apple App Store
DefiLlama is not the first crypto brand this has happened to, and it will not be the last. Clones of Rabby Wallet and Curve Finance have surfaced on the App Store before. Researchers counted 26 fraudulent wallet apps targeting seed phrases as recently as April. Apple says it rejects hundreds of thousands of copycat submissions a year, showing how widespread app impersonation has become.
Apple has yet to explain the part of 0xngmi’s account that matters most: why a founder’s trademark complaints went nowhere for months, while a self-inflicted wallet drain removed the same listing in days.
