Crypto · 17 August, 2026 · 2 min read
DeFiLlama Founder 0xngmi Says Apple Removed Fake App After Wallet Was Drained
Apple ignored phishing DeFiLlama apps for months before removal after evidence of wallet draining. DefiLlama delayed its mobile app launch until impersonating apps were removed from the App Store.
Founder used self-described “decoy”/self-hack, but some outlets omit the explicit wording.
8 of 10 outlets skipped it: attackers used name lending from a defunct company for KYC.
10outlets compared
Same story, two versions
tap a side to read it in full
Crypto News
“DefiLlama waited ’till all the fake apps were taken down before we launched ours”Read the original ↗
WEEX emphasises “decoy” method; others stress timeline and user-safety rationale.
Fake apps delay DeFiLlama
DeFiLlama delayed the public launch of its official mobile app for months after phishing apps impersonating the analytics platform targeted users on Apple’s App Store, according to the pseudonymous founder 0xngmi.
“Then we loaded a small wallet, downloaded the app, got drained as expected and reported it to Apple.”
0xngmi said the team spent months trying to get Apple to remove a fake DefiLlama app by reporting trademark violations and impersonation, but Apple removed the app only after the team downloaded it and let a small wallet be drained.
In a post dated 15 August, 0xngmi wrote, “Then we loaded a small wallet, downloaded the app, got drained as expected and reported it to Apple.”
He added that the delay was intentional, writing, “We waited till all the fake apps were taken down before we launched ours to avoid any user getting scammed.”
Apple moves after proof
0xngmi said Apple took the impersonating app down “in days” only after DefiLlama documented that the software could drain a funded wallet, while earlier reports about trademark and impersonation had not produced action.
Cointelegraph reported that it had approached Apple for comment, while the founder’s account emphasized that the team’s evidence was what changed the timeline.
In a separate account, 0xngmi described the tactic as abnormal, saying, “It’s abnormal that we have to go this far to protect users,” on X.
The episode also sits within a broader pattern of crypto brand impersonation, with the sources pointing to a fake Ledger Live app on the Microsoft Store that “resulted in the theft of $588,000 across 38 transactions.”
What’s at stake next
With the official app now live, the sources say Apple lists the genuine iPhone app as “DefiLlama: DeFi Tracker,” naming DEFILLAMA LIMITED as the provider, after the team waited for fake listings to be removed.
“Apple’s listing identifies the iPhone application as “DefiLlama: DeFi Tracker,””
The reporting also frames Apple’s App Review rules as prohibiting app impersonation and unauthorized use of another developer’s brand or product name, which is presented as the basis for why the impersonator listings should not have persisted.
The broader stakes for users are illustrated by prior losses tied to impersonation, including the Microsoft Store Ledger Live case where a fake app stole $588,000 across 38 transactions.
0xngmi’s account also links the delay to user safety, with the founder saying DefiLlama held back its release so that “all the fake apps were taken down before we launched ours,” aiming to avoid users getting scammed by lookalikes.