Apple is being sued by three people who claim approximately $1.8 million in Bitcoin was stolen after downloading and using a fraudulent Sparrow Wallet application from the App Store.
The complaint, filed on July 24 in California, alleges that Apple failed to adequately review and monitor applications distributed through the App Store while promoting the marketplace as a safe and trusted source for software.
Plaintiffs James Ramirez, Christopher Ellis, and Jalen Delgado say the malicious application impersonated the legitimate Sparrow Bitcoin wallet and instructed them to enter their seed phrases.
After entering those secret recovery credentials, the victims allegedly had their Bitcoin transferred to cryptocurrency wallets controlled by the scammers.
The legitimate Sparrow Wallet is a desktop application available for Windows, macOS, and Linux, and does not offer an iOS version.
However, Sparrow Wallet’s developer says that scammers have repeatedly published applications in Apple’s App Store that impersonate the cryptocurrency wallet.
Victims lost Bitcoin after earlier warnings
According to the complaint, Delgado downloaded the fraudulent application on or around May 1, 2025, entered his seed phrase, and shortly afterward discovered that 1.05033242 Bitcoin, worth approximately $120,000, had been transferred to a scammer.
Ramirez allegedly downloaded the app on July 25, 2025, and lost 7.4 Bitcoin, valued at approximately $875,000. The complaint says Ramirez reported the fraudulent app and theft to Apple that same day, but alleges Apple never contacted him regarding that report or subsequent reports.
Just over a week later, on or around August 3, Ellis allegedly also installed the Sparrow app from the App Store. After entering his seed phrase, Ellis discovered that approximately $840,000 in cryptocurrency had been transferred to a scammer and immediately reported the app and theft to Apple.
The complaint also claims that Apple ranked the fraudulent Sparrow app and included it in curated cryptocurrency app collections, effectively recommending it alongside legitimate applications.
However, Apple had allegedly been warned about fraudulent Sparrow Wallet apps more than a year before the plaintiffs’ losses.
The complaint includes a January 6, 2024 post from Craig Raw, the developer of the legitimate Sparrow Wallet application, who said a scam Sparrow Wallet app remained available in the App Store despite him and others reporting it weeks earlier.
Raw also warned users to only obtain Sparrow Wallet through its official website rather than trusting an application solely because it was available through an app store.
MacRumors also shared a more recent attempt by Raw to protect users from the fake Sparrow applications on the Apple App Store by submitting an unpublished placeholder app that explained that mobile apps using the “Sparrow Wallet” name were fake.
According to Raw, Apple initially flagged his developer account for termination over alleged dishonest activity, but later reversed the decision.
Apple told BleepingComputer that it acted quickly to remove applications impersonating Sparrow Wallet and terminated the developer accounts associated with them.
Apple also said developers who believe content distributed through its services infringes their intellectual property can submit a dispute to the company’s legal department.
Customers can separately report suspected App Store scams and fraud through Apple’s Report a Problem service, and Apple said it takes immediate action when applications are found to violate its guidelines.
The plaintiffs are seeking reimbursement for the stolen cryptocurrency, compensatory and punitive damages, restitution, attorneys’ fees, and other damages.
They are also asking the court to require Apple to improve and publicly disclose its procedures for detecting and removing fraudulent applications, while also introducing warnings about the risks associated with cryptocurrency apps.
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
