Fake 'Padre Terminal' Crypto App Linked to $23,000 in Solana Wallet Thefts

Blockchain investigators have identified a malicious iOS application, previously listed on the Apple App Store as 'Padre Terminal,' which allegedly drained approximately $23,000 from 27 Solana wallets. The app targeted users by prompting them to import private keys, which were then used to misappropriate cryptocurrency.

Incident Details

• Total Losses: Approximately $23,000 in cryptocurrency stolen across 27 wallets.
• Timeline: The thefts reportedly occurred starting October 25, 2026, with the drainer remaining active even after the app's removal.
• Modus Operandi: The attacker converted USDC to SOL to prevent potential asset freezing and transferred funds to secondary wallets.
• Status: Apple has confirmed the removal of the Padre Terminal app, along with other suspicious applications, and the termination of associated developer accounts.

Identified Suspicious Applications

Beyond the Padre Terminal app, researchers flagged four other applications on the App Store as potentially malicious, often disguised as productivity or analysis tools:

• Axiom Pro: Focus
• GMGN AI
• HyperTerminal-HyperliquidTools
• Pump Fun Tokens & Analytics

Protective Measures

Security experts advise users to exercise caution when downloading financial applications. Verifiable safety practices include:

• Only using links provided on official project websites.
• Avoiding apps with low download counts, limited user feedback, or developer names unrelated to the project.
• Remaining skeptical of apps that change their functionality after installation, such as those masquerading as productivity tools.