Philadelphia musician Garrett Dutton, better known as G. Love, said he lost 5.92 BTC after downloading a fraudulent Ledger wallet application from Apple’s App Store while setting up his hardware wallet on a new Mac. At the time the incident was reported, the stolen bitcoin was valued at roughly $424,175. According to Dutton, the funds represented retirement savings he had accumulated over about a decade.
A fake app that looked legitimate
The incident reportedly took place on April 11, 2026. Dutton said he was trying to install Ledger Live on a new Apple computer and searched the App Store for the official software. What he found appeared convincing enough to pass as a legitimate Ledger application. But the app was not published by Ledger and was instead part of a phishing operation designed to steal wallet recovery credentials.
After installation, the fake app prompted Dutton to enter his 24-word recovery phrase, also known as a seed phrase. Once that information was entered, the attackers gained access to the wallet and quickly drained his bitcoin. Dutton later posted publicly on X that he had suffered a major loss while moving his Ledger setup to a new computer, describing the stolen funds as his retirement savings.
He also shared a transaction hash and a bitcoin address, asking supporters who wanted to help him recover from the incident to send donations. He later clarified that only his bitcoin holdings were affected and that no other assets were involved.
Onchain tracking points to KuCoin deposit addresses
Blockchain investigator ZachXBT traced the stolen funds shortly after the incident became public. According to his findings, approximately 5.92 BTC was taken and then allegedly laundered through nine transactions that ultimately reached KuCoin deposit addresses. As with most bitcoin transactions, the transfers can be examined publicly through blockchain explorers.
The case quickly drew mixed reactions online. Many users expressed sympathy, while others questioned whether the story made sense because Ledger hardware wallets typically require physical confirmation on the device itself for outgoing transfers. Dutton responded by explaining that the hardware wallet had not been bypassed in the usual sense. Instead, he had been tricked through social engineering into voluntarily entering the seed phrase into malicious software. Once the recovery phrase was exposed, the attackers no longer needed the physical hardware device to access the wallet’s funds.
Why the hardware wallet could not protect him
The incident is a textbook example of a seed phrase compromise. Hardware wallets are designed to protect private keys by keeping them isolated from internet-connected devices. But that protection breaks down completely if a user hands over the seed phrase. The recovery phrase is the master backup to the wallet. Anyone who obtains it can regenerate the wallet and take control of all assets derived from that phrase.
In other words, the device itself was not “hacked” in the traditional sense. The attack succeeded because the victim was deceived into surrendering the one credential that should never be typed into a computer application, website, or app store download. Once the phrase was entered, the attackers had full and permanent access.
A pattern already documented on macOS
The report noted that this type of attack fits a broader pattern targeting macOS users. Cybersecurity firm Moonlock warned in 2025 about malware campaigns built to replace or imitate legitimate Ledger Live installations on Mac systems and then prompt users for recovery phrases. Searches for “Ledger” in Apple’s Mac App Store have also been known to return unofficial third-party applications rather than software from the actual Ledger developer, Ledger SAS.
That distinction matters because Ledger has repeatedly said its software should be downloaded only from ledger.com. The company has long warned users that it does not distribute consumer wallet software through app stores. Any listing that appears under a different developer name should be treated as suspicious or outright fraudulent.
Ledger’s standing warning remains unchanged
Ledger’s security guidance has been consistent for years: the recovery phrase must stay offline and must never be entered anywhere except directly on the hardware device during the initial setup process, if required by the device workflow. Typing the phrase into a desktop app, a mobile app, a browser page, or any online form effectively compromises the entire wallet.
That message is especially important for self-custody users. While hardware wallets reduce many common attack surfaces, they do not eliminate human error. A convincing fake interface, a spoofed application listing, or a malicious installer can still defeat the setup if the user is persuaded to reveal the seed phrase.
Public reaction and broader implications
Dutton addressed criticism on social media by saying the event should serve as a warning rather than a source of ridicule. He stated that he had been involved in crypto since 2017 and acknowledged that he was caught off guard. His comments underscored a difficult reality in digital asset security: even experienced users can fall victim to well-crafted scams, especially when they are performing routine actions such as migrating to a new computer or reinstalling wallet software.
The public response reflected a recurring divide in crypto culture. Some observers offered support and sympathy, viewing the incident as another example of platform spoofing and weak app marketplace controls. Others focused on personal responsibility, arguing that experienced users should know never to reveal a seed phrase. Both reactions point to the same underlying issue: self-custody offers control, but it also places the burden of operational security squarely on the user.
No legal action announced
As of the report’s publication, no legal action had been announced. The article also noted that major media outlets had not yet widely covered the case at that time. Dutton said he intended to move forward and expressed gratitude for his health, his family, and his music career, including a recent performance at Tortuga Fest.
For the broader crypto community, the takeaway is straightforward. Download wallet software only from verified official sources, confirm the publisher identity carefully, and treat any request for a recovery phrase as an immediate red flag. In self-custody, the seed phrase is the wallet. Once it is exposed, the protection provided by the hardware device is effectively gone.