A fake cryptocurrency trading application previously listed on Apple’s App Store remained connected to a series of Solana wallet thefts after its removal, while a separate wallet attributed to the 2022 Pando Rings exploit reportedly acquired 7,548 ETH worth approximately $16.72 million. The developments highlight two different aspects of cryptocurrency security: fraudulent applications that exploit users’ trust in established trading brands and the continued movement of assets associated with historical exploits.
Blockchain investigator Iris linked the counterfeit Padre Terminal application to a cluster of 27 drained Solana wallets and approximately $23,000 in losses since October 25. The attacker converted the remaining 4,070 USDC into SOL on October 29 before transferring 192 SOL to another wallet. Separately, blockchain analytics platform Lookonchain reported on October 30 that an Ethereum address attributed to the Pando Rings attacker had purchased 7,548 ETH.
Neither development represents a newly confirmed compromise of the underlying Solana or Ethereum networks. The Padre investigation concerns a fraudulent application and suspected wallet-draining activity, while the Pando-related transaction involves the movement of assets by a wallet associated with an exploit from November 2022.
Fake Padre Terminal App Linked to 27 Solana Wallet Thefts
The fraudulent Padre Terminal application was previously available through Apple’s App Store, impersonating the trading service associated with Padre, which was subsequently renamed Terminal by pump.fun. According to Iris, the legitimate Terminal service operates through the web rather than an official iOS application, making the counterfeit mobile listing an impersonation.
In its October 28 warning, Iris connected the application to a group of 27 compromised Solana wallets. The investigator estimated the associated losses at approximately $23,000 since October 25 and identified the attacker-controlled address as 3LAgKYoNenWrGWT3U4XWhpgVJWyYkP9wKpiPk8TJT1LN.
The investigation has an important attribution limitation. Iris specifically confirmed that one victim had been compromised after installing the malicious App Store application. The investigator has not established how the remaining wallets were compromised, meaning the full cluster cannot be attributed conclusively to installations of the same application.
BleepingComputer’s October 29 investigation identified two applications using the Padre name in Apple’s marketplace. The listing identified by Iris as malicious had the App Store identifier 6802739263, while another listing, ID 6717572591, was considered likely to be the legitimate pump.fun application, which had been available since October 2024. The fraudulent application has since been removed, and its listing returns a 404 error.
The suspected mechanism involves users importing their private keys into the counterfeit application. Iris believes the application may have loaded its trading interface remotely, although the investigator had not directly observed the wallet-draining screen. The distinction is important because the available evidence establishes the theft cluster and one confirmed connection to the application, rather than a complete technical reconstruction of every compromise.
The attacker continued moving funds after the application’s removal. On October 29, the wallet converted approximately 4,070 USDC into SOL, according to Iris. The conversion removed those funds from USDC, which has issuer-level freezing capabilities, and changed the composition of the attacker’s holdings.
The attacker subsequently transferred 192 SOL to a second address, H84yazsUVCF8eJ6brh27rURMHjdKEVv2BuLS4iuUUQbu. Iris reported that the two wallets held a combined 229.66 SOL at the time of the update, with no funds cashed out. The latest reported theft occurred at 17:06 UTC on October 29, demonstrating that removing the application did not immediately stop the associated draining activity.
The investigator also identified four other suspected cryptocurrency-brand impersonators on the App Store: Axiom Pro: Focus, GMGN AI, HyperTerminal-HyperliquidTools and Pump Fun Tokens & Analitycs. However, Iris has not independently confirmed cryptocurrency theft involving those separate applications. The researcher also found infrastructure connections among some impersonators, but specifically did not establish that Padre Terminal belonged to that same suspected cluster.
Pando Rings Exploit-Linked Wallet Reportedly Acquires 7,548 ETH
In a separate development, Lookonchain reported on October 30 that an Ethereum wallet attributed to the Pando Rings exploiter purchased 7,548 ETH worth approximately $16.72 million.
The transaction activity was associated with Ethereum address 0x303D0A175CeEC14DD7B3d4F60CABE6CEc06a3d9F. Lookonchain’s original alert described the acquisition as occurring approximately two hours before publication. The reported value implies an average acquisition cost of approximately $2,215 per ETH, calculated using the rounded headline figures rather than an independently established execution price.
The wallet’s reported connection to Pando Rings refers to the November 2022 exploit of the lending protocol operating on the Mixin Network. The attacker manipulated the price of an sBTC-WBTC liquidity-provider token used by the protocol’s oracle, allowing the extraction of assets through distorted collateral valuations.
Pando’s original incident disclosure described approximately $21.88 million in assets transferred out before intervention, while additional funds were reportedly frozen with assistance from Mixin Network and other parties. The historical attack should not be confused with the latest transaction: the October 30 acquisition is a movement attributed to an exploit-linked wallet, not evidence of a new attack against Pando or Ethereum.
Lookonchain’s alert links the transaction activity to the identified Ethereum address through its on-chain monitoring. Arkham also provides an address-level tracking page. However, the attribution remains dependent on blockchain intelligence research rather than independently established ownership of the wallet. The available information does not establish whether the ETH purchase represents investment, portfolio restructuring, preparations for further transfers or another purpose.
Why the Two Developments Matter for Crypto Security
The Padre incident illustrates a security weakness that cannot necessarily be addressed through conventional smart-contract audits. A counterfeit application can exploit the reputation of a recognizable trading platform and persuade users to disclose credentials that provide direct access to their wallets.
Importing a private key into an untrusted application creates a fundamentally different risk from connecting a wallet to a website. A conventional wallet connection generally exposes a public address and allows the website to request subsequent transactions. Private-key disclosure can give the recipient the ability to sign transactions independently, without needing the victim to approve each transfer.
This distinction also explains why removing the application from an app marketplace does not necessarily stop an ongoing theft campaign. Attackers who have already obtained private keys can continue accessing the associated wallets, regardless of whether the original application remains available for download.
The incident follows other cases involving compromised wallet credentials and fraudulent applications. Dave Finances previously examined a Trezor phishing campaign designed to transmit recovery phrases to a Telegram bot, illustrating how attackers can exploit the trust users place in established cryptocurrency brands. Its analysis of how to identify cryptocurrency scams before connecting a wallet also explains why users must distinguish ordinary wallet connectivity from requests involving private keys, recovery phrases and transaction-signing permissions.
For Apple, the case raises questions about application review procedures and the ability to identify impersonators before users install them. App Store availability can create a perception of legitimacy, but marketplace approval should not be treated as independent verification that an application belongs to the cryptocurrency project it claims to represent. The fact that BleepingComputer contacted Apple about the malicious application and other suspected impersonators, without receiving a response by publication, leaves the platform’s assessment of the incident unclear.
The Pando-related purchase raises a different monitoring issue. A wallet associated with a historical exploit can remain relevant years after the original incident, particularly when substantial balances move between assets or addresses. Such transactions may provide investigators with opportunities to identify new routes, potential exchange interactions or further attempts to redistribute funds.
However, a large purchase does not automatically indicate money laundering or a deliberate attempt to conceal stolen assets. The acquisition of ETH changes the wallet’s exposure to market movements and potentially its future liquidity, but the operator’s intentions cannot be determined from the purchase alone. Similarly, the use of tracking labels does not independently prove the identity of the person controlling an address.
Further Wallet Movements and App Store Investigations Remain Key
The next developments to monitor in the Padre case include whether the attacker moves the remaining SOL to additional wallets, interacts with centralized exchanges or attempts to convert the assets into other cryptocurrencies. The reported 229.66 SOL balance provides a reference point for subsequent monitoring, although it should not be treated as a current verified balance without another blockchain check.
Investigators will also need to determine whether the other 26 compromised wallets share a technical connection with the malicious application. Establishing that relationship could reveal whether the attack involved additional distribution channels, phishing websites or separate credential-stealing methods. The four other suspected impersonator applications warrant scrutiny, but allegations associated with them should remain separate until actual theft is independently demonstrated.
For the Pando-linked address, the important question is what happens to the newly acquired ETH. Further transfers, exchange deposits or interactions with privacy-focused services could provide additional evidence about the wallet’s activity. Until those movements are established, the reported $16.72 million purchase should be treated as an on-chain development rather than a confirmed laundering operation or a signal of broader Ethereum market demand.
Together, the incidents show why cryptocurrency security investigations must follow both the initial compromise and the subsequent movement of funds. A fraudulent application can remain financially dangerous even after its removal, while wallets linked to historical exploits can continue generating significant on-chain activity years later. In both cases, identifying an address is only the beginning of understanding where the money is going and who ultimately controls it.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574