The DefiLlama mobile app launch was held back for months because Apple repeatedly failed to act on phishing apps impersonating the DeFi analytics platform, according to pseudonymous founder 0xngmi.
The team made a deliberate call to stay off the App Store until every fake was gone. ‘We waited ’till all the fake apps were taken down before we launched ours to avoid any user getting scammed,’ 0xngmi wrote in a Saturday post on X.
What finally moved Apple to act was not months of formal complaints, but a documented proof of harm. DefiLlama downloaded one of the malicious apps, ran a small wallet through it, and recorded the drain on film. Apple removed that app within days. The broader campaign of reports had achieved nothing close to that speed.
Why the DefiLlama Mobile App Launch Was Held Back
The episode fits a pattern that security researchers have tracked across both major app marketplaces. Fake apps impersonating Rabby Wallet and Curve Finance appeared on the App Store in 2024. PhishFort previously documented a fake Ledger app that cleared Apple’s review process entirely.
The Microsoft Store has its own record here. In November 2023, a fake Ledger Live app listed there stole approximately 16.8 BTC, valued at $588,000, across 38 transactions, with the largest single transfer reaching $81,200, according to Investing.com, citing on-chain detective ZachXBT. Forklog puts the total higher at $768,000 across various cryptocurrencies; the discrepancy likely reflects non-BTC assets that ZachXBT’s BTC-denominated figure did not include.
The common thread across these incidents is platform review failure rather than sophisticated technical bypass. These apps are not exploiting zero-days. They are passing submission reviews by mimicking legitimate brand assets, then draining wallets from users who trusted the marketplace’s curation.
What the App Actually Does Now
With the fakes cleared, DefiLlama’s genuine app is now live on both iOS and Android, crypto.news reports. The product ships with LlamaAI, an AI research analyst covering crypto, DeFi, and traditional finance, sitting on top of data from 8,478 protocols across 555 chains, per DefiLlama’s own app page.
That data footprint is the core of what made the platform worth impersonating in the first place. DefiLlama is the default TVL reference for most of the industry. A convincing fake would intercept users who are already serious enough about DeFi to seek out dedicated tooling, making the target pool smaller but the average wallet size larger.
Cointelegraph reported that it approached Apple for comment. Apple had not responded publicly at the time of writing.
The DefiLlama mobile app launch is now complete, but the underlying problem, platform review processes that cannot reliably catch brand impersonation before funds are lost, remains unresolved. The next team in this position will face the same timeline: months of ignored reports, then a documented drain, then action. For users, the practical implication is simple: verify the developer name on any App Store listing against the protocol’s official site before connecting a wallet.
