FomoPeek iPhone App Found Carrying iOS Exploit Kit That Steals Crypto Wallet Keys

A wallet-tracking app for iPhone carried malicious code designed to break out of Apple's security sandbox and extract cryptocurrency credentials from infected devices, according to a warning from blockchain security firm SlowMist.

FomoPeek, marketed as a tool for monitoring whale wallets across Solana, Ethereum and TRON, contained two hidden modules unrelated to its advertised functions, SlowMist said in an asset-theft alert issued September 19. The firm linked versions 1.1 and 1.2 to reported crypto thefts after a joint investigation with OKX's security team.

The disclosure capped a turbulent stretch for crypto security, arriving alongside several unrelated incidents over the weekend. Blink temporarily suspended services after an attacker drained custodial accounts, while Fetch.ai and NuNet suffered a separate $2 million exploit.

Eight Attack Methods Target iOS Kernel

One of the malicious modules embedded in FomoPeek contained an iOS kernel exploitation framework with eight distinct attack methods, capable of adapting to different device models and operating-system versions. SlowMist identified the affected range as spanning iOS 12.0 through 18.7 and iOS 26.0 through 26.1.

Once the exploit succeeded, the code could escape the application sandbox, decrypt Keychain information and read data belonging to other apps. Potentially exposed material included private keys, recovery phrases, login credentials, chat records and other files stored on the device.