Forklog Fake Padre Terminal App Drains $23K from Solana Wallets
Article Content
- •The fake Padre Terminal app drained $23,000 from 27 Solana wallets.
- •Users were compromised by importing private keys into the malicious app.
- •The app has been removed, but thefts continued even after its removal.
A malicious app named Padre Terminal on the Apple App Store has been linked to the theft of approximately $23,000 from 27 Solana wallets. Users were compromised after importing their private keys into the app, which was disguised as a cryptocurrency trading platform. Blockchain researcher Iris confirmed that one victim was directly compromised through the app, but the method used to compromise the other wallets remains unclear. The app has since been removed from the App Store, but the attacker continued to drain funds, with the latest theft reported on October 29, 2026. The stolen funds were traced to a specific Solana address, and the attacker converted USDC into SOL before transferring it to a new wallet. Additionally, several other suspicious apps impersonating crypto brands were identified on the App Store, raising concerns about widespread impersonation tactics.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (3)
Following this threat?
Track Amadey and CVE-2026-98432 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
How many wallets were affected?
What should users do if they used the app?
Is the app still available?
Continue Reading
AI-Driven Cyber Threats Surge, Disrupting Essential Services in Australia The Australian Signals Directorate (ASD) warns of increased disruptions to essential services due to a surge in AI-powered cyber threats. The agency's annual cyber threat report reveals an 80% rise in notifications of potential malicious activity, totaling over 4,400 incidents. Director-General Abigail Bradshaw states… 
Amadey Malware Distributed via SmokeLoader: Threat Analysis Amadey malware, a Windows trojan bot first identified in 2018, is currently being distributed through SmokeLoader, a malware known for delivering additional malicious payloads. This malware family can steal information and install further malware by executing commands from remote attackers. Recent statistics indicate…