Fake Ledger Live app on the Apple App Store.

Last week, a counterfeit Ledger Live app sat on Apple's Mac App Store for nearly a week and drained $9.5 million from 50+ users, one claiming to have lost their life savings.

Victims typed their 24-word recovery phrases into the app during normal wallet setup or recovery.

The wallet worked. The secure chip worked. The cryptography worked. The mechanism of the seed phrase made all of that irrelevant the moment it left the device.

A password can be typed into anything, which is why a convincing fake site can steal it. A passkey is cryptographically bound to the real site it was registered for, so the fake one never even gets the option to ask.

As long as recovery depends on 24 words a human can type anywhere, your life savings are only as secure as the most convincing fake UI.