Fake Crypto Wallet App on Apple's App Store Drained $11.8 Million in EOS; Uzbek Man Pleads Guilty

Published Oct. 28, 2026. Case statuses are current as of that date.

A crypto wallet is only as safe as its private key. Hand that key to the wrong app and whoever controls the app controls your money. Federal prosecutors in Buffalo say that is exactly what happened to one user in 2018, who lost cryptocurrency then worth about $11.8 million after typing his key into an app he bought from Apple's App Store.

Nikita Andreevich Sklyuev, also known as Valeriy Dorojkin, 39, of Uzbekistan, pleaded guilty to wire fraud before U.S. District Judge Richard J. Arcara, the U.S. Attorney's Office for the Western District of New York announced on Oct. 19, 2026 [1]. The charge carries a maximum of 20 years in prison and a $250,000 fine.

Important: Sklyuev has pleaded guilty but has not yet been sentenced. Sentencing is scheduled for March 16, 2027.

How the scheme worked, step by step

According to the U.S. Attorney's Office [1]:

1. Publishing the app. In June 2018, Sklyuev submitted an app called "EOSIO Wallet Explorer" to Apple for sale through the App Store.
2. The disguise. The app claimed to be a cryptocurrency wallet. In fact, prosecutors said, it was malicious software designed to steal the user's private key, giving Sklyuev access to the user's funds.
3. The victim installs it. In September 2018, a person in the Western District of New York bought the app and installed it on his iPhone.
4. The key is entered. After installation, the user entered his private key. That gave Sklyuev unauthorized access to the user's wallet, which held about 2,092,395.5356 EOS, then worth about $11.8 million.
5. The lockout. On Sept. 25, 2018, Sklyuev changed the private key to the wallet, cutting the owner off from his own account.
6. Moving the coins. In February 2019, Sklyuev transferred the EOS from the wallet to numerous other online wallets he controlled.

EOS is the cryptocurrency tied to the EOSIO blockchain software; the app's name borrowed that branding. The release does not say how Sklyuev was identified or brought to court, whether any funds have been recovered, or whether other users downloaded the app. We don't speculate on those points.

The person charged and his status

Nikita Andreevich Sklyuev, a/k/a Valeriy Dorojkin, 39, of Uzbekistan. Pleaded guilty to wire fraud before Judge Arcara. Sentencing is set for March 16, 2027, at 10:30 a.m. The FBI and the U.S. Marshals Service investigated [1].

A guilty plea is a conviction, but the sentence and any restitution order are still to be decided.

Why this matters

App stores review software, but malicious apps sometimes get through, and a fake wallet is a particularly effective trap: it asks for the one secret that matters, and users expect to be asked for it. Whether it's called a private key, a seed phrase or a recovery phrase, anyone who has it can take everything in the wallet, and blockchain transfers generally can't be reversed.

Red flags

These are general warning signs of this kind of scheme; not every one is alleged in this case.

• A wallet app from a developer you can't verify, or one whose name imitates a well-known blockchain or brand.
• An app that asks you to type in an existing private key or seed phrase right after you install it. Legitimate wallets do offer an "import" option, which is exactly why fakes copy it.
• Few reviews, recent publication, or reviews that read like ads.
• A paid "wallet" for a network whose official tools are free.
• Links to a wallet from social media, ads or direct messages rather than from the project's official website.

What to do if you're targeted

1. Get wallet software only from the official project website, and follow its link to the correct app listing. Check the developer name.
2. Never enter your seed phrase or private key into an app or website you haven't verified. No support agent needs it.
3. Keep large holdings in a hardware wallet whose key never leaves the device.
4. If you think a key was exposed, move any remaining funds immediately to a new wallet created on a trusted device.
5. Report it to the FBI at ic3.gov, to the FTC at ReportFraud.ftc.gov, and report the app to the app store.
6. Beware of "recovery" services that promise to get stolen crypto back for an upfront fee. Many are scams.

Case status (as of Oct. 28, 2026)

Defendant	Court	Status	Source
Nikita Andreevich Sklyuev, a/k/a Valeriy Dorojkin, 39, of Uzbekistan	U.S. District Court, W.D.N.Y. (Judge Richard J. Arcara)	Pleaded guilty (wire fraud), announced Oct. 19, 2026; sentencing March 16, 2027	[1]

Statuses can change.

Sources

1. U.S. Attorney's Office, Western District of New York, "Uzbekistan man pleads guilty to his role in cryptocurrency scheme," Oct. 19, 2026. https://www.justice.gov/usao-wdny/pr/uzbekistan-man-pleads-guilty-his-role-cryptocurrency-scheme

---

Corrections and updates: If you are named in this article, or represent someone who is, and believe anything here is inaccurate or out of date (including a dismissal, acquittal, or change in case status), please contact us at editorandchief@scammers.com. We will review it and update the article promptly.