DefiLlama delayed the public launch of its mobile application while trying to remove applications impersonating the DeFi analytics platform from Apple’s App Store, pseudonymous founder 0xngmi said on Aug. 15.
Summary
- DefiLlama delayed its mobile launch until fake App Store listings were removed, founder 0xngmi said.
- Apple removed one impersonating app within days after DefiLlama demonstrated it could drain cryptocurrency funds.
- DefiLlama’s official iPhone app is now live, with Apple listing DEFILLAMA LIMITED as its provider.
- Apple’s guidelines prohibit app impersonation and unauthorized use of another developer’s brand or product name.
- Fake crypto apps have repeatedly reached Apple’s store, including recent Ledger and Sparrow wallet cases.
The team eventually demonstrated that one fake application could drain a funded crypto wallet before Apple removed it, according to his post.
0xngmi said DefiLlama had reported the application for months over trademark and impersonation concerns without securing its removal. The team then funded a small test wallet, downloaded the application and watched the funds disappear. “App was taken down in days after that,” he wrote. The amount drained from the test wallet was not disclosed.
DefiLlama waited until fake apps were removed
The security problem directly affected DefiLlama’s product rollout. 0xngmi said the company “waited ’till all the fake apps were taken down before we launched ours to avoid any user getting scammed.” That timeline is DefiLlama’s account and has not been independently confirmed by Apple.
The genuine DefiLlama application is now publicly available. DefiLlama’s official page says its mobile product is live on iOS and Android. Apple’s listing identifies the iPhone application as “DefiLlama: DeFi Tracker,” names DefiLlama as the developer and lists DEFILLAMA LIMITED as the provider.
Meanwhile, Apple’s App Review guidelines prohibit applications that impersonate other apps or services. The rules also bar developers from using another developer’s icon, brand or product name without permission. Repeated impersonation can lead to removal from the Apple Developer Program.
Apple has not publicly addressed 0xngmi’s specific account in the official materials reviewed for this report. The company has previously said its App Review system evaluates applications for security and safety, and Apple reported rejecting more than 320,000 submissions in 2024 because they copied other apps, constituted spam or otherwise misled users.
Fake crypto apps have caused documented losses
The DefiLlama dispute follows other cases where fake cryptocurrency applications reached Apple’s marketplace. As crypto.news reported, a fraudulent Ledger Live application drained 5.9 BTC worth roughly $420,000 from musician Garrett Dutton in April. On-chain researcher ZachXBT traced the stolen Bitcoin to addresses associated with KuCoin.
Apple is also facing a U.S. lawsuit involving three users who allege fake Sparrow Wallet apps caused $1.835 million in Bitcoin losses. Those allegations have not been tested in court. Apple said in that case that it removed impersonating applications and terminated related developer accounts.
In related coverage, a fake Phantom Wallet application also reached Apple’s App Store before being removed after users reported losing funds.
What happens next
DefiLlama’s official app is now active, and its website provides direct access to the legitimate mobile product. The iOS listing currently shows version 1.0.5 and identifies defillama.com as the developer website, giving users multiple details to verify before installation.
The founder has not disclosed the attacker addresses, amount stolen during DefiLlama’s test or technical analysis of the malicious application. Those details would be needed to independently reconstruct the wallet drain. For users, the clearest verified safeguard is to reach the mobile application through DefiLlama’s official website and confirm the listed developer and provider rather than relying only on an App Store search result.
