If you hold cryptocurrency, there’s a very simple golden rule that you should always follow. Never hand over your seed phrase.
Garrett Dutton, better known as G. Love – the front man of blues-hip-hop outfit G. Love & Special Sauce – has learnt that lesson the hard way.
In what must have been a painful admission earlier this month, G. Love described how while setting up a new computer, he downloaded what he believed was the legitimate Ledger Live app from Apple’s official App Store.
The bogus app tricked the singer into entering his seed phrase – the master key to his cryptocurrency holdings. With that vital information in their hands, the thieves were able to steal 5.9 Bitcoin (approximately US $440,000), which G. Love had been holding for ten years and considered to be his retirement fund.
A seed phrase (also known as a recovery phrase) is the sequence of 12 or 24 words that are generated when you set up a cryptocurrency wallet. Anyone who has the seed phrase has full, irrevocable access to your funds – making it impossible to reverse any fraudulent transfers made into someone else’s account without your permission.
The real Ledger Live app will never ask you for your seed phrase. In fact, no legitimate wallet software ever will ask for it. If any app requests your seed phrase, it is a scam.
It won’t be much consolation for G. Love, but he’s not the only one to suffer.
Renowned cryptocurrency investigator ZackXBT revealed on Telegram that the same fake Ledger Live app had been linked to the theft of some US $9.5 million from more than 50 victims between April 7-13, with the three victims hardest hit each lost seven-figure sums.
Apple removed the app from its online store on April 12, but not before the damage had been done.
It remains to be seen whether victims will launch a class action against Apple due to their heavy losses, but serious questions must be asked about the thoroughness of the company’s App Store vetting due to the fact that the app remained available long enough to defraud dozens of people.
G. Love, who says he is not a naive newcomer to cryptocurrency, has publicly reached out to Apple – but does not appear to have had any response.
If you hold cryptocurrency, here is what you can do to better protect yourself.
- Never enter your seed phrase into any app, website, or form — for any reason whatsoever.
- Be especially careful when setting up a new device. That is precisely when you are most likely to search for and reinstall familiar apps, and exactly when scammers are counting on you to drop your guard.
- Check developer names and ratings carefully. Fake apps often attempt to mimic a real product’s branding.
In the past Apple has presented its App Store as a more secure and safer place to find and download apps than other operating systems. G. Love’s loss of a ten-year retirement fund serves as a timely lesson that trust in platforms can easily be misplaced.