A trading app that never traded sat on Apple’s storefront until an on-chain detective traced stolen funds to it. Padre Terminal promised low-fee deals on Solana meme coins. What it collected were private keys, then wallets.
Blockchain investigator Iris tied roughly $23,000 to 27 Solana wallets, starting October 25. One victim’s loss is confirmed as coming through the app. The rest share the drain pattern but no proven entry point. Genuine Padre, now Terminal by pump.fun, runs on the web only, which makes every mobile lookalike hostile by definition.
The drainer outlived the takedown
Apple pulled the listing, and the page now returns nothing. Theft continued anyway. Iris logged a fresh transfer at 17:06 UTC on October 29, after removal, because the interface looks remotely served rather than baked into the binary. Reviewers approved an app whose malicious screen was never shipped inside it.
The escape route looks deliberate. About 4,070 USDC tokens were swapped into SOL on October 29, killing any hope of Circle freezing the stablecoin. Roughly 192 SOL then moved to a second wallet. Together the two addresses held about 229.66 SOL, untouched when Iris published.
Four more lookalikes still listed
At least five copycats were named, among them Axiom Pro: Focus, GMGN AI and HyperTerminal-HyperliquidTools. Their blurbs read harmless. Their reviews do not. Axiom Pro drew about 25 theft allegations dating to February, one reviewer noting it posed as a meme coin trader before becoming a focus tool.
A script on the fake Axiom site referenced backend addresses shared with Aster and GMGN clones, pointing to one operator.
Apple has not commented. The March 2024 playbook holds: reach listings through the project’s official site, and treat a thin review history from an unrelated publisher as the warning it is.
