iPhone App Leads to Crypto Theft of Half a Million Euros - Here's What We Know Now

The iPhone app FomoPeek has been linked to the theft of nearly $580,000 (approximately €500,000) in crypto. Researchers found hidden software in versions 1.1 and 1.2 that could breach the security of iPhones and read crypto keys from other apps.

In Brief:

• FomoPeek was available in the App Store and posed as an innocent crypto tracker.

• The app could read data from Apple's Keychain and other apps after a successful attack.

• Users of versions 1.1 and 1.2 need to create new keys on a clean device and move their crypto.

Confirmed App Attack Follows Safari Warning

Yesterday, there was talk of a potentially dangerous Safari vulnerability. In that reported attack, a malicious webpage could breach the browser's shielding. This would put recovery phrases and crypto keys at risk.

The case surrounding FomoPeek seems unrelated but shows a similar danger. Here, the attack did not start with a malicious website but with an app from Apple's official store.

SlowMist and the security team of crypto exchange OKX actually found the malicious code. There is no indication that both reports concern the same vulnerability or attackers.

SlowMist
@SlowMist_Team
·Follow

🚨 SlowMist TI Alert: FomoPeek App v1.1--1.2 Asset Theft 🚨 We have recently received multiple reports of users having assets stolen. Our investigation found that the affected cases involved private key exposure, and some of the users had previously installed and used @FomoPeek Show more


7:26 AM · Sep 19, 2026
246
Reply
Copy link
Read 50 replies

Innocent Tracker Breached Its Shielding

FomoPeek was marketed as a tracking app that only read public data. Users could track large transactions on Solana, Ethereum, and TRON without linking a wallet or entering a recovery phrase.

However, according to SlowMist's warning, versions 1.1 and 1.2 contained two hidden components. One of them had eight ways to exploit vulnerabilities in iOS. The app could automatically choose an attack that matched the device and the iOS version used.

After a successful attack, FomoPeek could escape the digital shielding that normally separates apps from each other. The software could then read Apple's Keychain and files from other apps.

This put private keys, recovery phrases, and login credentials at risk, even if they were never entered in FomoPeek itself.

Nearly $580,000 (approximately €500,000) in crypto was sent to the attackers' main address. The total amount of damage is not known.

International Cyber Digest
@IntCyberDigest
·Follow

‼️ BREAKING: An app on Apple's official App Store was serving iPhone users malware designed to steal crypto wallet keys. SlowMist and OKX found FomoPeek versions 1.1 and 1.2, distributed Sept 9--17, hid a kernel exploit framework built to escape the iOS sandbox, decrypt the Show more


4:59 PM · Sep 22, 2026
1.3K
Reply
Copy link
Read 37 replies

New Wallet Must Be on Clean Device

Simply deleting the app is not enough. A stolen key remains usable. SlowMist therefore advises creating a new crypto wallet with new keys on a trusted device that has never had FomoPeek installed.

After that, funds should be moved as quickly as possible. Users are also advised to update iOS and not to reinstall FomoPeek.