A fake crypto app and thousands of exposed keys show why secret codes must stay secret. Here are 9 simple steps for homes, offices and trips.
A fake crypto trading app on Apple's App Store was linked to about $23,000 stolen from 27 wallets. In a separate report, a researcher found 26,400 working cloud and AI keys left in public code. The advice today is simple. Never type a secret key into an app you have not checked, and treat any key you ever posted publicly as exposed.
What happened
According to BleepingComputer, an app called Padre Terminal pretended to be a crypto trading tool. It drained wallets after people imported their private keys into it. A private key is a secret code that controls a crypto wallet. Anyone who has it can move the money.
The real Padre service, now called Terminal by pump.fun, is web-only, says blockchain investigator Iris. That means any mobile app using its name is fake. The app was removed from the App Store, but the theft kept going after that. Iris also flagged at least four more suspected copycat apps. Iris has not confirmed theft from those four.
The second report, from The Hacker News, covers researcher Ben Zimmermann. He scanned 7.25 million public projects on Gitee, a Chinese code-hosting site. He found 26,400 keys that still worked. An API key is like a password that one program uses to talk to a service. Most were for cloud and AI services.
Both stories share one lesson. A secret key works for whoever holds it. The tips below help you keep yours safe.
Tips for you and your family
1. Check if the service even has an app
Some services work only in a web browser. Before you download, visit the company's official website and see what it offers. If the site says it has no app, then an app with that name did not come from the company.
2. Read the low reviews before you install
The fake apps had harmless descriptions. But some reviews told the truth. One app, Axiom Pro: Focus, had about 25 reviews saying it stole from wallets. Sort reviews by lowest rating and read a few. Words like "stolen" or "scam" are a clear sign to stop.
3. Never type a private key or recovery phrase into a new app
A recovery phrase is a list of words that can rebuild your wallet. Treat it like the key to your house. If a new app asks for it, stop. Check with the company's official website first.
4. If you already typed it in, move fast
Removing the app does not undo the damage. In this case, the theft kept going after the app was taken down. Create a new wallet with an app you trust. Then move your funds to it right away.
5. Tell family that apps can change
One reviewer said an app looked like a coin trading tool, then turned into a focus app. Another app called itself a notes app. Explain to teens and older relatives that the name on an icon may not match what the app does. Ask them to check with you before they connect any money app.
Tips for small businesses
6. Revoke any key that was ever public
Deleting a key from your code is not enough. Truffle Security, which makes the TruffleHog scanner, notes that removing a key or rewriting the code history does not revoke it. Scanners can read the full history of a project. Log in to the provider, cancel the old key, and make a new one. OpenAI says a stolen key can lead to data loss and "unexpected charges."
7. Use more than one scanner
A scanner is a tool that searches code for secrets. In this study, two scanners each found about half of the working keys. Only 1,001 were found by both. Check that your scanner can detect keys for the services you actually use.
8. List the AI helpers in your browsers
A BleepingComputer guide on AI agents explains that these tools can now act inside a browser. An AI agent is a program that clicks and types for you. It acts with your identity, so a website sees it as you. It can also read hidden instructions in pages or emails. This risk is called prompt injection. Make a list of AI extensions and AI browsers on work computers. Remove any you do not need.
Tips for travelers
9. Set up money apps at home, not at the airport
When you rush, it is easy to grab the first app in a search. Before a trip, install the banking and payment apps you need while you are at home. Check each one against the company's website. Keep your recovery phrase on paper in a safe place at home, not in a photo on your phone. Then a lost phone on the road does not hand over your wallet.
The bottom line
A secret key is only safe while it stays secret. Check an app before you trust it with money. Cancel any key that has been public, even for a short time. And know which AI tools are acting in your name.
Have a question about anything here? Email me at sales@appwt.com or call (888) 565-0171, and I will answer it.
Sources
- Fake crypto app on Apple App Store linked to $23K wallet theft, BleepingComputer, 2026-10-29
- 26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee Repositories, The Hacker News, 2026-10-29
- 3 Ways AI Agents Already Operate in Your Browser, BleepingComputer, 2026-10-29
Tags
Frequently Asked Questions
How did the fake crypto app steal money?
It drained wallets after people imported their private keys into it. About $23,000 was taken from 27 Solana wallets.
Is the fake app still in the App Store?
No. The Padre Terminal app was removed. But the theft kept going after it was taken down.
If I delete a key from my code, is it safe again?
No. Deleting a key or rewriting the code history does not revoke it. You need to cancel the key with the provider.
What can someone do with a stolen OpenAI key?
OpenAI says another person can use your account's quota without your consent. That can cause data loss, unexpected charges and interrupted access.
Why do AI browser agents carry risk?
They act with your identity, so websites see their actions as yours. They can also follow hidden instructions placed in pages or emails.
Enjoyed this article?
Share it with your network
