Phishing appUpdated
Fake "Padre" App Store app tied to a drainer that hit 27 wallets
27 wallets, 229.66 SOL still held
A fake "Padre" app on the App Store asked for private keys. One Solana drainer emptied 27 wallets since Oct 25, swapped the USDC to SOL, and still holds 229.66 SOL in 2 wallets.
Funds parkedUpdatedKey facts
- Amount
- About 165.3 SOL + 5,441.45 USDC + memecoins drained; all swapped to SOL; 229.66 SOL (about $23K) still held
- Victims
- 27 Solana wallets, Oct 25 to Oct 29
- Date
- Oct 25, 2026
- Where the funds are
- As of 18:41 UTC Oct 29: 229.66 SOL (about $23K) in 2 wallets, 37.664 SOL in the drainer and 192.000 SOL in H84ya...UQbu, unchanged since 11:55 UTC. Nothing cashed out or bridged.
- Freezable
- Nothing at the token level: all USDC was swapped to SOL (0 USDC held), and SOL cannot be frozen. The funds are still in 2 wallets, so exchanges or bridges can act if the SOL reaches them.
- Addresses
3LAgKYoNenWrGWT3U4XWhpgVJWyYkP9wKpiPk8TJT1LNSolana, Drainer, holds 37.664 SOLH84yazsUVCF8eJ6brh27rURMHjdKEVv2BuLS4iuUUQbuSolana, Fresh wallet, got 192 SOL from the drainer at 11:53 UTC Oct 29
Updates
Balances re-read: drainer 37.664 SOL, H84ya 192.000 SOL, 229.66 SOL in total (about $23K), unchanged since 11:55 UTC. Nothing cashed out or bridged.
The Padre Terminal App Store page (id6802739263) returns 404. The latest drain was at 17:06 UTC (6.86 SOL); 27 wallets in total.
192 SOL moved to a fresh wallet, H84yazsUVCF8eJ6brh27rURMHjdKEVv2BuLS4iuUUQbu.
The drainer swapped its last 4,070.71 USDC to 40.50 SOL. 0 USDC left, nothing for Circle to freeze.
The drainer swapped 853.08 USDC and a memecoin balance to SOL, removing most of what Circle could have frozen.
14 wallets now (the latest at 20:47 UTC). The drainer holds 83.76 SOL and 836.62 USDC.
Public board: 13 wallets drained since Oct 25. The drainer has cashed out nothing and holds 78.69 SOL and 836.62 USDC, which Circle can freeze.
What happened
One Solana address has been emptying wallets since Oct 25 2026:
3LAgKYoNenWrGWT3U4XWhpgVJWyYkP9wKpiPk8TJT1LN
Each drain is signed with the victim's own key. The first drain was at 10:56 UTC Oct 25 and the latest Iris counted was at 17:06 UTC Oct 29 (6.86 SOL). By then 27 wallets had been drained into this one address. The biggest single victim lost 3,200 USDC at 11:26 UTC Oct 29.
The fake app
At least one victim imported a private key into a "Padre" app from the Apple App Store. A "Padre Terminal" app was listed on the App Store as a productivity app. Padre, now called Terminal, has no native app: it runs on the web only, at trade.padre.gg. Not every victim used the app. At least one says they never installed it, so the app is one route into this drainer, not proven to be the only one.
The listing Iris checked, apps.apple.com/us/app/padre-terminal/id6802739263, returned 404 at 17:46 UTC Oct 29. Apple's US lookup API still returned the app at the same moment, probably from a stale cache.
What the drainer did with the money
Total drained: about 165.3 SOL, 5,441.45 USDC and some memecoins. The drainer swapped all the USDC and the memecoins to SOL. Its last swap turned 4,070.71 USDC into 40.50 SOL at 11:52 UTC Oct 29. It now holds 0 USDC.
At 11:53 UTC Oct 29 it moved 192 SOL to a fresh wallet:
H84yazsUVCF8eJ6brh27rURMHjdKEVv2BuLS4iuUUQbu
Where the funds are now
At 18:41 UTC Oct 29 the drainer held 37.664 SOL and the fresh wallet held 192.000 SOL: 229.66 SOL in total, about $23K. The balances had not changed since 11:55 UTC. Nothing has been cashed out or bridged.
What can still be done
There is no USDC left for Circle to freeze. On Oct 28 the drainer still held 836.62 USDC, which Circle could have frozen; it swapped 853.08 USDC to SOL at 21:26 UTC that night. The 229.66 SOL is still in two wallets, so the open lever is an exchange or bridge if it moves there.
If you typed a key or seed phrase into a "Padre" app, treat that wallet as burned. Move what is left to a new wallet, and report the theft to the police and to Apple.
Count notes
The 27 victim wallets are wallets whose own balance dropped into the drainer in a transaction they signed. Left out of the count: zero-value lookalike "poisoning" senders, one ambiguous 0.29 USDC transfer, and one 4.9993 SOL transfer from a wallet created the same day (Oct 28 22:51 UTC).