0xngmi, the anonymous founder of analytics site DeFi Llama, said he downloaded a fake DeFiLlama app from the App Store, funded a small wallet, and let the app steal the money as proof of fraud.
Apple removed the app just days after it was reported, having ignored months of complaints about trademark infringement and impersonation.
How Did the DeFiLlama Founder Get Apple to Remove the Fake App?
In a series of posts on X on August 15, 2026, user 0xngmi stated that DeFiLlama spent months reporting the fake DeFiLlama app in the App Store to Apple through abuse and trademark infringement channels, citing impersonation and trademark violations, but no action was taken.
The app remained in the App Store until user 0xngmi funded a wallet with a small amount of cryptocurrency, installed the fake app, and confirmed it drained the funds. After he reported this to Apple, the app was removed within a few days.
"I understand it's crazy that you have to do this to protect users from clearly fake apps," he wrote, adding that he is publicizing this incident so other crypto teams "don't waste time like we did."
User 0xngmi described the fake app as a simple copy of DeFiLlama that someone "coded with vibeCode" solely to ask users for their seed phrase—the secret recovery words that provide full control over a crypto wallet.
He said the same scammers were spamming with clone apps of other major crypto brands and passing Apple's identity verification checks by registering under the names of bankrupt companies. In DeFiLlama's case, he said, the scammers passed their know-your-customer check using as an example a small, family-run shoe-cleaning business that was registered about 40 years ago and is no longer operational.
What Caused the Delay in DeFiLlama's App Launch?
The DeFiLlama team decided to delay the official app launch by several months until all fake versions were removed, so no user would accidentally download a fraudulent one.
DeFiLlama already uses LlamaSearch, a directory of verified crypto domains, precisely because search and app store results are so often manipulated.
Tracking impersonation cases, Cryptopolitan has recorded similar incidents on the App Store and other platforms. On August 14, 2026, a Hyperliquid trader lost about $550,000 in USDC after paid Google ads redirected him to a cloned version of the exchange. In May 2026, scammers tricked over $400,000 from Uniswap users through fake Google ads, with roughly 146 ETH ending up in two attacker addresses.
In November last year, Cryptopolitan also found a fake Hyperliquid app on the Google Play store.
end-content
