{"id":22697,"date":"2026-08-16T19:44:05","date_gmt":"2026-08-16T19:44:05","guid":{"rendered":"https:\/\/cryptoted.net\/index.php\/2026\/08\/16\/defillama-founder-says-apple-took-months-to-remove-fake-app\/"},"modified":"2026-08-16T19:44:05","modified_gmt":"2026-08-16T19:44:05","slug":"defillama-founder-says-apple-took-months-to-remove-fake-app","status":"publish","type":"post","link":"https:\/\/cryptoted.net\/index.php\/2026\/08\/16\/defillama-founder-says-apple-took-months-to-remove-fake-app\/","title":{"rendered":"DefiLlama founder says Apple took months to remove fake app"},"content":{"rendered":"<p> <br \/>\n<br \/><img decoding=\"async\" src=\"https:\/\/media.crypto.news\/2024\/02\/crypto-news-apple-option04.webp\" \/><\/p>\n<div>\n<p class=\"is-style-lead\">DefiLlama delayed the public launch of its mobile application while trying to remove applications impersonating the DeFi analytics platform from Apple\u2019s App Store, pseudonymous founder 0xngmi said on Aug. 15.\u00a0<\/p>\n<div id=\"cn-block-summary-block_182e769522dc1f0492336f6c8761bd6f\" class=\"cn-block-summary\">\n<p>\n        <span class=\"tabs__item is-selected\">Summary<\/span>\n    <\/p>\n<div class=\"cn-block-summary__content\">\n<ul class=\"wp-block-list\">\n<li>DefiLlama delayed its mobile launch until fake App Store listings were removed, founder 0xngmi said.<\/li>\n<li>Apple removed one impersonating app within days after DefiLlama demonstrated it could drain cryptocurrency funds.<\/li>\n<li>DefiLlama\u2019s official iPhone app is now live, with Apple listing DEFILLAMA LIMITED as its provider.<\/li>\n<li>Apple\u2019s guidelines prohibit app impersonation and unauthorized use of another developer\u2019s brand or product name.<\/li>\n<li>Fake crypto apps have repeatedly reached Apple\u2019s store, including recent Ledger and Sparrow wallet cases.<\/li>\n<\/ul><\/div>\n<\/div>\n<p><!-- .cn-block-summary --><\/p>\n<p>The team eventually demonstrated that one fake application could drain a funded crypto wallet before Apple removed it, according to his <a href=\"https:\/\/x.com\/0xngmi\/status\/2088473910903800051\" target=\"_blank\" rel=\"nofollow\">post<\/a>.<\/p>\n<p>0xngmi said DefiLlama had reported the application for months over trademark and impersonation concerns without securing its removal. The team then funded a small test wallet, downloaded the application and watched the funds disappear. \u201cApp was taken down in days after that,\u201d he wrote. The amount drained from the test wallet was not disclosed.<\/p>\n<figure class=\"wp-block-embed is-type-rich is-provider-x wp-block-embed-x\">\n<div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">We had been trying to take down a fake DefiLlama app on apple\u2019s store for months, telling Apple about trademark violations, impersonation\u2026<\/p>\n<p>Then we loaded a small wallet, downloaded the app, got drained as expected and reported it to Apple.<\/p>\n<p>App was taken down in days after that<\/p>\n<p>\u2014 0xngmi (@0xngmi) <a rel=\"nofollow\" href=\"https:\/\/x.com\/0xngmi\/status\/2088473910903800051?ref_src=twsrc%5Etfw\">August 15, 2026<\/a><\/p><\/blockquote>\n<\/div>\n<\/figure>\n<p>    <!-- .cn-block-related-link --><\/p>\n<h2 class=\"wp-block-heading\"><strong>DefiLlama waited until fake apps were removed<\/strong><\/h2>\n<p>The security problem directly affected DefiLlama\u2019s product rollout. 0xngmi said the company \u201cwaited \u2019till all the fake apps were taken down before we launched ours to avoid any user getting scammed.\u201d That timeline is DefiLlama\u2019s account and has not been independently confirmed by Apple.<\/p>\n<p>The genuine DefiLlama application is now publicly available. DefiLlama\u2019s official <a href=\"https:\/\/defillama.com\/app\" target=\"_blank\" rel=\"nofollow\">page<\/a> says its mobile product is live on iOS and Android. Apple\u2019s listing identifies the iPhone application as \u201cDefiLlama: DeFi Tracker,\u201d names DefiLlama as the developer and lists DEFILLAMA LIMITED as the provider.<\/p>\n<p>Meanwhile, Apple\u2019s App Review <a href=\"https:\/\/developer.apple.com\/app-store\/review\/guidelines\/\" target=\"_blank\" rel=\"nofollow\">guidelines<\/a> prohibit applications that impersonate other apps or services. The rules also bar developers from using another developer\u2019s icon, brand or product name without permission. Repeated impersonation can lead to removal from the Apple Developer Program.<\/p>\n<p>Apple has not publicly addressed 0xngmi\u2019s specific account in the official materials reviewed for this report. The company has previously said its App Review system evaluates applications for security and safety, and Apple reported rejecting more than 320,000 submissions in 2024 because they copied other apps, constituted spam or otherwise misled users.<\/p>\n<h2 class=\"wp-block-heading\"><strong>Fake crypto apps have caused documented losses<\/strong><\/h2>\n<p>The DefiLlama dispute follows other cases where fake cryptocurrency applications reached Apple\u2019s marketplace. As crypto.news reported, <a href=\"https:\/\/crypto.news\/fake-ledger-live-app-on-apple-app-store-drains-5-9-btc-from-g-love\/\" target=\"_blank\">a fraudulent Ledger Live application drained 5.9 BTC worth roughly $420,000<\/a> from musician Garrett Dutton in April. On-chain researcher ZachXBT traced the stolen Bitcoin to addresses associated with KuCoin.<\/p>\n<p>Apple is also facing a U.S. lawsuit involving<a href=\"https:\/\/crypto.news\/apple-faces-1-8m-lawsuit-over-fake-bitcoin-app\/\" target=\"_blank\">\u00a0 three users who allege fake Sparrow Wallet apps caused $1.835 million in Bitcoin losses<\/a>. Those allegations have not been tested in court. Apple said in that case that it removed impersonating applications and terminated related developer accounts.<\/p>\n<p>In related coverage, <a href=\"https:\/\/crypto.news\/fake-phantom-wallet-breaches-apples-app-store-draining-crypto-assets\/\" target=\"_blank\">a fake Phantom Wallet application also reached Apple\u2019s App Store<\/a> before being removed after users reported losing funds.<\/p>\n<h2 class=\"wp-block-heading\"><strong>What happens next<\/strong><\/h2>\n<p>DefiLlama\u2019s official app is now active, and its website provides direct access to the legitimate mobile product. The iOS listing currently shows version 1.0.5 and identifies defillama.com as the developer website, giving users multiple details to verify before installation.<\/p>\n<p>The founder has not disclosed the attacker addresses, amount stolen during DefiLlama\u2019s test or technical analysis of the malicious application. Those details would be needed to independently reconstruct the wallet drain. For users, the clearest verified safeguard is to reach the mobile application through DefiLlama\u2019s official website and confirm the listed developer and provider rather than relying only on an App Store search result.<\/p>\n<p>    <!-- .cn-block-related-link --><\/p><\/div>\n<p><br \/>\n<br \/><a href=\"https:\/\/crypto.news\/defillama-says-apple-took-months-to-remove-fake-app\/\">Source link <\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>DefiLlama delayed the public launch of its mobile application while trying to remove applications impersonating the DeFi analytics platform from Apple\u2019s App Store, pseudonymous founder 0xngmi said on Aug. 15.\u00a0 Summary DefiLlama delayed its mobile launch until fake App Store listings were removed, founder 0xngmi said. Apple removed one impersonating app within days after DefiLlama [&hellip;]<\/p>\n","protected":false},"author":5,"featured_media":22698,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"tdm_status":"","tdm_grid_status":"","footnotes":""},"categories":[23],"tags":[],"kronos_expire_date":[],"class_list":["post-22697","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-crypto"],"_links":{"self":[{"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/posts\/22697","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/comments?post=22697"}],"version-history":[{"count":0,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/posts\/22697\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/media\/22698"}],"wp:attachment":[{"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/media?parent=22697"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/categories?post=22697"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/tags?post=22697"},{"taxonomy":"kronos_expire_date","embeddable":true,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/kronos_expire_date?post=22697"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}