At least 1.6M stolen from a wallet drainer in Apple's App Store - Cointelegraph reports!

Yesterday Cointelegraph doxxed a Web3 hacker for his role in the fake Rabby_IO Wallets that made it into the app store before the real one earlier this year.

Konstantin Pylinskiy aka konpyl, CEO of Moonward Capital, is the person held responsible according to the Cointelegraph article.

This is the first instance I can recall of a major media company doxxing a hacker with a very detailed analysis of the theft!

The widely reported scam took place on Feb 16th 2024, but I'm showing based on victim reports it happened first on Dec 23rd 2023 and possibly as early as Oct 2023.

A twitter post from a user scammed by the fake Rabby Wallet on Dec 23rd 2023

I came across a few Support threads related to the fake Rabby wallets uploaded, one being here on Reddit, the other on a forum on Apple's own website.

Additionally, when the hack initially happened, most Media outlets reported the theft in the mid six figures.

The article by Cointelegraph mentions the amount at over 1.6 MILLION lost. A full accounting is needed to get the true number.

How the Fake Rabby Wallet Scam Happened

To get past Apple's strict review process with a wallet drainer not once, but at least twice, maybe even three times is quite the feat! If one of the most secure and trusted companies around can get scammed multiple time, no one is safe in web3!

The prevailing theory is the malicious developer of the fake Rabby Wallet applied to the iOS App Store under some generic fintech name. The app itself would appear innocent enough to the reviewer.

Once the app was approved, the developer was able to change the name to "Rabby Wallet & Crypto Solution" while inserting malicious code to turn that innocent little financial app into a vicious crypto drainer.

When DeBank announced the launch of the real Rabby Wallet in the app store, the fake Rabby Wallet was already live while the real Rabby Wallet was still in Apple's approval process.

The accused bad actor, "konpyl", was able to drain numerous unsuspecting victims who thought they were engaging with the real Rabby Wallet, but instead got a fake one that targeted their crypto assets.

Tracing the Funds

Tracing the funds mentioned in the Cointelegraph article between 0x4E9395cc1075b57016BF8b5bF8782BFEF94c71C2 (left image) and 0x44BdB19dB1Cd29D546597AF7dc0549e7f6F9E480 (right image).

The flow of funds from the article can be extremely difficult to follow along at home but I'll do my best! A more detailed post about all of the wallets mentioned would make for a very lengthy analysis.

The research does look pretty spot on. The main connection I see to "konpyl" is that wallet with his former Opensea username - 0x44BdB19dB1Cd29D546597AF7dc0549e7f6F9E480 and the Rhinofi output wallet of 0x4E9395cc1075b57016BF8b5bF8782BFEF94c71C2 mentioned in the article.

I counted 6 txns worth almost 100k and found some shared deposit address activity between the two wallets as well.

It's nearly impossible to get a true number of the total amount lost in the scam and wallets involved without a detailed analysis of the theft dates. 1.6M lost could be a conservative number and the total victim account could be much higher.

Apple's Role in the Theft

It's wild to think malicious web3 applications can consistently make it into Apple's App Store. Traditionally, Apple has had a "hands off" approach when it comes to these things.

The Cointelegraph article mentions Google's approach, which appears to put in some effort to stop bad actors by publicity going after individuals who abuse Google Play.

I do think Apple has an obligation to protect users from any and all threats that appear in the App store.

Also due to the public nature of this theft, I'm hopeful for some recovery for some of the victims!