On April 11, 2026, American musician Garrett Dutton, known by his stage name G. Love (frontman of G. Love & Special Sauce), lost nearly 5.92 Bitcoin — his entire retirement savings held for almost a decade — after downloading a counterfeit Ledger Live application from the Apple Mac App Store. At the time of the theft, the stolen funds were valued at approximately $424,175.
The Attack: A Social Engineering Vector
Dutton revealed the incident on X (formerly Twitter) the same day. He explained that he was setting up his Ledger hardware wallet on a new Mac computer and searched for the official Ledger Live app in the App Store. The app he downloaded appeared legitimate but was in fact a malicious clone designed to steal seed phrases. After entering his 24-word recovery seed, the attackers immediately drained his Bitcoin wallet. Dutton emphasized that he was not hacked through the hardware device itself, but rather socially manipulated into voluntarily providing his seed phrase — the exact attack vector the fake app was built to exploit.
On-Chain Forensics and Community Reaction
Prominent on-chain investigator ZachXBT quickly traced the stolen funds. He confirmed that approximately 5.92 BTC was moved through nine transactions to deposit addresses associated with the centralized exchange KuCoin, where the funds were likely being laundered. The transaction hashes are publicly visible on any Bitcoin block explorer.
The crypto community on X had mixed reactions. While many expressed sympathy, others questioned the credibility of the story, noting that hardware wallets require physical confirmation on the device. Dutton responded by acknowledging his own mistake: “It was my own fucking fault for not being more careful. But let this be a warning — there are so many scams out there.” He also expressed gratitude for his health, family, and music career, including a recent performance at Tortuga Fest.
Repeated Pattern Targeting macOS Users
This incident follows a documented pattern of attacks targeting macOS users. In 2025, cybersecurity firm Moonlock reported malware designed to replace legitimate Ledger Live installations on macOS and trick users into entering seed phrases. A search for “Ledger” in the Mac App Store often returns fake apps listed by third-party sellers rather than the genuine developer, Ledger SAS.
How to Stay Safe
Ledger has repeatedly stated that its software is only available through the official website at ledger.com. The company has no presence in consumer-facing app stores. Any app appearing under a different developer name should be considered fraudulent. The core rule of self-custody: a seed phrase should never leave the physical hardware device. It should only be entered directly on the device during initial setup. Entering it into any app, website, or computer compromises the entire wallet permanently.
As of April 12, 2026, no mainstream media outlets had covered the story, and no legal action has been announced. Bitcoin.com News was the first to report on the incident.