Toast Wallet Plus Malicious IPhone App

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' section to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

File:Toastwallet.jpg

Toast Wallet

A legitimate "Toast" wallet, created in 2017 by StarStone Unlimited in New Zealand, was designed to be simple and safe for storing Ripple (XRP). However, a deceptive app, "Toast Plus," appeared on the Apple App Store, with a similar name and logo. Many users downloaded Toast Plus, thinking it was related to the genuine Toast wallet. Unfortunately, it was a phishing program created to steal cryptocurrency by tricking users into revealing their account information. Many users lost cryptocurrency stored in this deceptive app and took various steps to investigate the theft. Apple faced a class action lawsuit for hosting this fraudulent app but argued that it was protected by Section 230 of the Communications Decency Act.

This is a global/international case not involving a specific country.

About Toast Wallet

"Toast is a Ripple (XRP) non-custodial wallet that was created in 2017 by a company named StarStone Unlimited, based in New Zealand, Dunedin.

The StarStone corporation was also established in 2017 by Richard Holland, and it seems that the wallet is their only product launched so far. They claim that the wallet was created to be “simple enough for your grandma but safe enough for a Swiss banker.”"

"Toast Plus - XRP Wallet Easy and Secure XRP Storage"

"Toast Plus is XRP wallet that is simple and safe to use. It works with a PIN and a Hierarchical Deterministic (HD) passphrase for extra protection."

"Toast Plus is a product of Peninsula Software and has not been authorized, endorsed, sponsored or otherwise approved by Ripple or its affiliates."

"[T]he App Store is more than just a storefront — it’s an innovative destination focused on bringing you amazing experiences. And a big part of those experiences is ensuring that the apps we offer are held to the highest standards for privacy, security, and content. Because we offer nearly two million apps — and we want you to feel good about using every single one of them."

"I read a lot of good things about the Toast wallet here, but the comments were mostly from 1-2 years ago. I downloaded the “Toast Plus” app on Apple store assuming this was the same one... it even showed up high in search when I searched XRP Wallet (I know, not smart at all) and it had 35 reviews."

"Plaintiff believed that Toast Plus was a version of Toast Wallet, a wellknown cryptocurrency wallet, as the names were similar and the logo used for the application in the App Store was the same or nearly identical."

"Josue Armenta scammed using the app [T]oast [P]lus." "He's in Mexico."

"On or about January 2, 2018, Plaintiff caused approximately 474 Ripple (“XRP”) cryptocurrency coins to be transferred from the Bittrex cryptocurrency exchange to a secure cryptocurrency wallet, called Rippex." "Rippex shut down February 2nd, 2018; however, Plaintiff could still access her coins from any secure wallet. Plaintiff thereafter linked her private XRP key, or a seed phrase, into Toast Plus in March of 2021." "As Plaintiff intended to hold the XRP as an investment and not to actively trade it, she did not check the Toast Wallet Plus application after entering her seed phrase into it." "In August of 2021, Plaintiff checked her account on Toast Plus, and discovered that not only did she have no XRP in the Wallet, her account was "deleted" on March 3, 2021."

"Plaintiff thereupon began investigating the matter, and discovered that Toast Plus was not in fact a version of the legitimate Toast Wallet application, but was instead a “spoofing” or “phishing” program created for the sole purpose of stealing cryptocurrency, by obtaining consumers' cryptocurrency account information and thereafter routing the same to the hackers' personal accounts."

"The application Toast Plus's sole purpose is to entice consumers to divulge their cryptocurrency account information, by mimicking an established cryptocurrency wallet in name, mark, and design, thereby allowing hackers to steal that cryptocurrency."

"Plaintiff took the following steps to investigate the theft of her property: contacting or attempting to contact Toast Plus; investigating Toast Plus through online resources; contacting Apple; contacting the Federal Trade Commission and the Federal Bureau of Investigations; and identifying co-conspirators involved in the fraudulent acts through online research."

"Plaintiff downloaded the application known as Toast Plus from the Apple App Store on or about March of 2020 onto her iPhone."

"Pursuant to Federal Rule of Civil Procedure 23(a)(1), the members of the Classes are so numerous and geographically dispersed that individual joinder of all Class members is impracticable. While Plaintiff is informed and believes that there are at least hundreds or thousands of members of the Class, the precise number of Class members in Maryland and Nationwide is unknown to Plaintiff, but may be ascertained from Defendant's books and records. Class members may effectively and efficiently be notified of the pendency of this action by recognized, Court-approved dissemination methods, which may include U.S. mail, electronic mail, Internet postings, and/or publication."

"Plaintiff personally has suffered more than $5,000 in direct consequential economic damages as a result of Defendant's acts and omissions, in that she lost cryptocurrency of value, and has spent her time investigating the source and method of the fraud, determining who was responsible, contacting law enforcement agencies, and communicating with Defendant to attempt to investigate and remediate the fraud, to no avail, and conferring with legal counsel on the fraud and any remedies."

"Just weeks ago, Apple announced the settlement of another class action suit filed by US-based software developers, promising better terms for the people who make much of the software that iPhone users run."

"From the beginning, the App Store has been an economic miracle; it is the safest and most trusted place for users to get apps, and an incredible business opportunity for developers to innovate, thrive and grow," the company said in a press release announcing the changes, which are pending approval by a judge.

"Apple Inc. escaped a proposed class action brought over a fraudulent cryptocurrency wallet app that was available for download on its App Store, after a federal judge in San Francisco ruled the tech company’s platform is shielded by Section 230 of the Communications Decency Act.

Hadona Diep sued Apple in Maryland federal court in September, accusing the company of hosting “Toast Plus,” a fraudulent mobile application for a crypto wallet that had a similar name and similar or identical logo to its legitimate counterpart. When Diep checked its status, she found that the lookalike app had deleted her account"

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - Toast Wallet Plus Malicious IPhone App

Date	Event	Description
January 29th, 2021 3:43:25 PM MST	RevNimshi Reddit Post	Reddit user RevNimshi attempts to warn about the wallet but this post gets no reaction and appears to be deleted.
January 29th, 2021 3:45:32 PM MST	Reddit Post	A Reddit thread is started with a warning about the Toast Plus wallet.
January 29th, 2021 3:45:32 PM MST	RevNimshi Reddit Post	A Reddit thread is started with a warning about the Toast Plus wallet which reports a loss of 19,000 XRP.
January 29th, 2021 4:38:29 PM MST	cryptowalk Loss Report	Reddit user cryptowalk reports being involved in the loss.
February 18th, 2021 11:12:31 AM MST	IngarethaSybiil Comment	The user IngarethaSybiil reports that their funds were taken from the same application "last week".
February 24th, 2021 9:24:10 PM MST	CryOptimusPrime Wallet Emptied	The blockchain transaction referenced by CryOptimusPrime for 2,294.940000 XRP.
February 24th, 2021 9:40:00 PM MST	CryOptimusPrime Wallet Deleted	A blockchain transaction deletes the wallet of CryOptimusPrime in order to retrieve an additional 14.993850 XRP.
February 27th, 2021 7:58:53 PM MST	CryOptimusPrime Comment	The user CryOptimusPrime reports losing 2294 XRP on February 25th, 2021 in a comment on Reddit.
February 28th, 2021 9:23:18 AM MST	bobsaget_26 Investigation	The Reddit user bobsaget_26 reports that they "know exactly who the Dev is" and "have gathered up a list of places to report your theft to and how to stop this guy from stealing from others".
March 3rd, 2021	Hadona Diep XRP Theft	Hadona Diep from Maryland reports that their XRP account was emptied and deleted on this date, prompting the lawsuit.
March 4th, 2021	alritedi Reddit Comment	The Reddit user alritedi reports that their funds were stolen on this date.
March 10th, 2021 10:03:53 AM MST	meatloafsmoobs Investigation	meatloafsmoobs comments to report that they work for one of the cryptocurrency exchanges and believe that the individual responsible may have an account at their exchange. They aren't willing to disclose which exchange they work for.
April 11th, 2021 8:32:46 PM MDT	alritedi Reddit Comment	The Reddit user alritedi reports realizing that they lost their funds based on seeing the Reddit post. It "definitely gave a perspective that [they] could use [their] hardware wallets a little more".
April 13th, 2021 11:07:16 PM MDT	GEGpilot Loss Reported	GEGpilot reports that the Toast Plus wallet "cleaned [them] out" and describes their situation as "so depressing".
April 20th, 2021 11:49:24 AM MDT	StatisticianNo5316 Reddit Comment	StatisticianNo5316 reports that they were just robbed by the same application. They also report that the scammer has now adopted the nickname "bobsaget26".
April 20th, 2021 12:49:12 PM MDT	VapoRubUser Reddit Comment	VapoRubUser reports having their funds stolen and sent to the blockchain address r3XGwhMrnfWf72vm3Yh5H23PiLoDKxcXc.
May 27th, 2021 1:21:11 PM MDT	Last Reddit Comment	The latest Reddit comment from a user who lost their funds.
May 27th, 2021 1:21:11 PM MDT	retrorick77 Reddit Comment	Reddit user retrorick77 reports losing "all [their] xrp [a] few days ago on toast wallet plus". "Is there anything to be done?"
September 20th, 2021 5:48:49 AM MDT	Crypto News Flash Article	Crypto News Flash publishes an article about the lawsuit against Apple.
September 16th, 2023	Hadona Diep Apple Lawsuit	Hadona Diep from Maryland files a lawsuit against Apple for hosting the fraudulent Toast Plus application.

Technical Details

This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

Total Amount Lost

The total amount lost has been estimated at $500,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.