Leva Heal Limited (Fake Ledger Live App - Apple App Store)
Summary
Leva Heal Limited is a UK-registered company (Companies House number 12178110) whose Apple developer account was used to publish a fraudulent application impersonating Ledger Live on the macOS App Store between April 7 and April 13, 2026. The app harvested users' 24-word seed phrases, resulting in the theft of approximately $9.5 million in cryptocurrency from at least 50 victims. Apple removed the app and terminated the associated developer account on or around April 13-14, 2026, after community reports surfaced through on-chain investigator ZachXBT.
Connected Entities
1 entities · 10 linked investigations- + 1 more
Timeline(11 events)
2019-08-28
Leva Heal Limited incorporated in England and Wales under the name Khiron Life Sciences UK Limited (Companies House number 12178110).
Companies House (GOV.UK)2024-09-10
Company renamed from Khiron Life Sciences UK Limited to Leva Heal Limited.
Companies House (GOV.UK)2025-01-01
Michael Anthony Steele (Canadian national) becomes person with significant control (75%+ shares and voting rights) of Leva Heal Limited.
Companies House (GOV.UK)2026-04-07
Fraudulent 'Ledger Live' app published on Apple macOS App Store under developer name 'Leva Heal Limited'; first victim fund thefts begin.
BleepingComputer / CoinDesk / The Block2026-04-08
First documented large theft: approximately $1.95 million in Bitcoin, ETH, and staked ETH stolen from a single victim.
CoinDesk / HackRead2026-04-09
Second large documented theft: approximately $3.23 million in USDT stolen from a single victim.
CoinDesk / CoinTelegraph2026-04-11
Third large documented theft: approximately $2.08 million in USDC stolen from a single victim. Musician G. Love (Garrett Dutton) also loses 5.92 BTC (approximately $420,000-$447,000) after entering his seed phrase into the fake app.
Decrypt / Bitcoin.com News / CoinDesk2026-04-13
App removed from Apple App Store. Apple terminates the associated developer account.
9to5Mac / MacRumors / AppleInsider2026-04-14
ZachXBT publishes public investigation report linking fake Ledger Live app to $9.5 million theft from 50+ victims; major media coverage begins. CoinDesk, AppleInsider, The Block report on the incident.
The Block / CoinDesk / AppleInsider2026-04-15
Ledger CTO Charles Guillemet issues public statement warning users that the real Ledger Live 'will never ask for your 24 words.'
CoinTelegraph / BleepingComputer2026-04-20
Alleged KuCoin account freeze deadline cited in connection with stolen funds held at KuCoin deposit addresses; no confirmed fund recovery reported.
AppleInsiderDecision Log
- hash: H11yFjQS6N7jftAq48zMiy8Y1ZQPV7R7KAvjaezRK7r8
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 6/30/2026, 11:06:26 PM
last updated: 6/30/2026, 11:06:37 PM
avoid.net — verified advice for a post-truth world