A fake wallet app slipped onto the App Store and drained $1.8M — the habit that stops it

Three Bitcoin owners are suing Apple after counterfeit versions of a wallet app called Sparrow appeared on the App Store and drained a combined $1.8 million. Each of them did the same thing before losing their coins: they typed their secret recovery phrase into an app they trusted because it sat in the official store.

Sparrow Wallet only runs on desktop computers — Windows, macOS and Linux — and has never shipped an iPhone version, so any App Store listing under its name is an impersonation. Its developer, Craig Raw, had been warning about copycats since early 2024. According to the complaint filed on July 24 in California, one victim reported a fake app and his loss to Apple on the day it happened; another downloaded a Sparrow app from the store nine days later and lost about $840,000.

The reason these losses are total and permanent comes down to what a recovery phrase is. Those 12 or 24 words are the master key to a self-custody wallet — anyone who has them can move every coin inside it. A genuine wallet stores that key on your own device; a fake one simply collects the words you type and hands them to a thief. There is no bank and no payment processor that can reverse the transfer afterward.

This is not a one-off. Security firm Kaspersky said in April it had found 26 fraudulent apps impersonating brands like MetaMask, Ledger and Coinbase, and a musician reported losing 5.9 BTC to a fake Ledger app from the store. Apple says it removed the fake Sparrow apps, terminated the developer accounts and rejected hundreds of thousands of malicious submissions — but the cases show that a store badge is not a guarantee of safety.

For a beginner, one habit prevents almost all of this: never type your recovery phrase into an app you just installed. A real wallet rarely asks for it, a desktop-only wallet has no mobile version to download, and download links should come from the project's own official website rather than a store search. When something feels urgent or unclear, stop before you enter the phrase. This is information, not advice.