DeFiLlama founder 0xngmi said he deliberately allowed a fraudulent App Store application to drain cryptocurrency from a funded wallet. The move created evidence that the impersonating application was stealing funds from users.
Apple removed the fake application days after receiving that evidence, according to 0xngmi. The removal followed months of complaints submitted through Apple’s abuse and trademark reporting channels.
The pseudonymous founder shared details of the incident on X on August 15, 2026. He said reports identified trademark violations and impersonation, but the listing remained available.
DeFiLlama Founder Demonstrates Fake App Theft
0xngmi said he downloaded the fraudulent DeFiLlama application and placed a small amount of cryptocurrency inside a wallet. He then allowed the application to access the wallet and drain those funds.
After documenting the theft, he submitted the result to Apple as evidence of fraud. The application was removed from the App Store within days of that report.
“I know it’s insane you have to do this to save users from obviously fake apps,” 0xngmi wrote. He said he shared the experience so other cryptocurrency teams “don’t waste time like us.”
According to 0xngmi, the fraudulent application was a basic DeFiLlama copy designed to request users’ seed phrases. Those recovery words provide control over cryptocurrency wallets and their assets.
Fake Crypto Apps Used Defunct Companies for Verification
0xngmi said the operators also created impersonating applications targeting other cryptocurrency brands. He claimed they passed Apple’s identity checks by registering their applications through defunct companies.
For the DeFiLlama impersonation, the operators allegedly completed verification using a shoe-shine company. The business had been incorporated around 40 years earlier and was no longer operating.
DeFiLlama delayed the launch of its legitimate application for months while fake versions remained available. The team wanted every copy removed before releasing its app to reduce accidental downloads.
DeFiLlama also operates LlamaSearch, a directory of vetted cryptocurrency domains. The service addresses risks when manipulated search results or app listings direct users toward fraudulent websites.
Similar Crypto Impersonation Scams Hit Other Platforms
The incident follows other cryptocurrency impersonation schemes involving advertising and application platforms. On August 14, a Hyperliquid trader lost about $550,000 in USDC after following a Google advertisement.
The advertisement directed the trader to a cloned Hyperliquid exchange. In May 2026, fake Google advertisements targeting Uniswap users resulted in losses exceeding $400,000.
Around 146 ETH from those Uniswap incidents reached two attacker addresses. Cryptopolitan also reported a fraudulent Hyperliquid application appearing on the Google Play Store in November 2025.
The DeFiLlama case highlights the unusual method 0xngmi used after months of unsuccessful complaints. By documenting an actual wallet drain, he provided evidence that prompted Apple’s removal.
