Garrett Dutton, better known as G. Love of the band G. Love & Special Sauce, lost approximately 5.92 Bitcoin (worth $424,175 at press time) on April 11, 2026, after installing a fake Ledger Live application from the Apple Mac App Store. The funds represented his entire retirement savings, which he had held for nearly a decade.
How the Attack Happened
According to posts on X, Dutton was setting up his Ledger hardware wallet on a new Apple computer. He searched the Mac App Store for “Ledger Live” and found an app that appeared legitimate. After downloading and launching it, the app prompted him to enter his 24-word seed phrase (recovery phrase). Believing the app was official, he typed in the phrase. Immediately afterward, his Bitcoin holdings were drained to an external address.
“I had a really tough day today — I lost my retirement fund in a hack/scam when I switched my Ledger over to my new computer,” Dutton wrote. He posted the transaction hash and a receiving address, asking followers to send funds if they wished to help him recover. He later clarified that only his Bitcoin was affected; no other crypto assets were compromised.
Onchain Tracing and Public Reaction
Onchain investigator ZachXBT quickly tracked the stolen funds. He confirmed that 5.92 BTC was transferred across nine transactions into deposit addresses linked to the KuCoin exchange. This suggests the attacker(s) attempted to launder the funds through the exchange. KuCoin later told Bitcoin.com News that it has established compliance procedures and is reviewing the matter, though it declined to comment further due to ongoing investigation.
Public response on X was mixed. Many expressed sympathy for Dutton, while others questioned the story’s plausibility, noting that Ledger hardware wallets require physical confirmation on the device itself. Dutton acknowledged that he was socially engineered into voluntarily entering his seed phrase — exactly the attack vector the scam was designed to exploit. “It was my own damn fault for not being more diligent. But let it serve as a warning. There’s so many scams,” he wrote.
Industry Context: App Store Scams Are a Known Issue
This incident follows a documented pattern. Cybersecurity firm Moonlock reported in 2025 on malware that replaced legitimate Ledger Live installations on macOS and tricked users into entering their seed phrases. The Mac App Store has hosted impostor apps listed by third-party sellers rather than the real developer, Ledger SAS. Ledger has repeatedly stated that its software is only available through ledger.com and is not present in any consumer app store.
The attack mechanics are straightforward: a user searches an app store, finds a convincing copy, installs it, and is prompted to enter their seed phrase. Once the seed phrase is typed into any app, website, or computer, the attacker gains full, permanent access to every wallet derived from that phrase. The hardware wallet itself provides no protection once the seed is exposed.
What Users Should Do
Self-custody requires that the seed phrase never leave the physical Ledger device. It should only be entered directly on the device during initial setup. Never type it into any app, even if the app appears official. Always download Ledger Live exclusively from the official website: ledger.com.
As of April 12, 2026, no major news outlets had covered the story; Bitcoin.com News was the first to report. Dutton has not announced any legal action. He expressed gratitude for his health, family, and music career, including a recent performance at Tortuga Fest.
This article was updated on April 19, 2026, to include KuCoin’s response.