DeFiLlama founder intentionally got hacked to force Apple to remove fake app
- DeFiLlama founder 0xngmi says that he funded a wallet, let a fake DeFiLlama app drain it, and submitted that as evidence to Apple.
- Apple took down the app days after receiving the evidence, following months of ignored trademark complaints.
- The app asked users for their seed phrases, and the same operators have targeted other crypto brands by verifying with defunct companies.
0xngmi, the pseudonymous founder of DeFi analytics site DeFiLlama, said he downloaded a fake DeFiLlama app from the App Store, funded a small wallet, and let the app steal the money as proof it was a scam.
Apple removed the app just days after his download, after ignoring months of trademark and impersonation complaints.
How did the founder of DeFiLlama get Apple to remove a fake app?
In a series of posts on X on August 15, 2026, 0xngmi said DeFiLlama had spent months flagging a fake DeFiLlama app on the App Store to Apple through its abuse and trademark channels, citing impersonation and trademark violations, and got no action.
The listing remained on the App Store until 0xngmi loaded a wallet with a small amount of crypto, installed the fake app, and confirmed it drained the funds. Once he reported that result to Apple, the app came down in days.
“I know it’s insane you have to do this to save users from obviously fake apps,” he wrote, adding that he was publicizing the episode so other crypto teams “don’t waste time like us.”
0xngmi described the fake app as a basic copy of DeFiLlama that somebody had “vibecoded,” all for the purpose of prompting users for their seed phrase, the secret recovery words that grant full control of a crypto wallet.
He said the same operators had been spamming lookalike apps for other major crypto brands and passing Apple’s identity checks by registering under dead companies. In DeFiLlama’s case, he said, the scammers completed know-your-customer verification using a mom-and-pop shoe-shine business that had been incorporated roughly 40 years earlier and no longer operates.
What delayed the launch of the DeFiLlama app?
DeFiLlama’s team decided to push back the real launch of the app by months until every fake version was gone, so that no user would download a scam by mistake.
DeFiLlama already runs LlamaSearch, which is a directory of vetted crypto domains, precisely because search and app-store results are so often manipulated.
Cryptopolitan has tracked cases of impersonation similar to the App Store incident across other platforms. On August 14, 2026, a Hyperliquid trader lost about $550,000 in USDC after a paid Google ad sent them to a cloned version of the exchange. In May 2026, scammers pulled more than $400,000 from Uniswap users through fake Google ad listings, with roughly 146 ETH landing in two attacker addresses.
Cryptopolitan also flagged a fake Hyperliquid app on the Google Play Store last November.
The smartest crypto minds already read our newsletter. Want in? Join them.
FAQs
How did DeFiLlama get the fake app removed from Apple's App Store?
0xngmi loaded a small wallet, downloaded the counterfeit app, confirmed it drained the funds, and reported that result to Apple, which removed the listing within days after months of inaction on trademark and impersonation complaints.
What did the fake DeFiLlama app do to users?
According to 0xngmi, it was a basic copied version of DeFiLlama that prompted users for their seed phrase, giving the scammers full access to the victim's crypto wallet.
How did the scammers pass Apple's identity checks?
0xngmi said the operators completed KYC verification using dead companies, in DeFiLlama's case a mom-and-pop shoe-shine business incorporated about 40 years ago that no longer operates.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Hannah Collymore
Hannah is a writer and editor with nearly a decade of blog writing and event reporting experience in the crypto space. At Cryptopolitan, Hannah contributes to the news page, reporting and analyzing the latest developments in DeFi, RWA, crypto regulation, AI and frontier tech industries. She graduated from Arcadia university with a degree in Business Administration.
