FomoPeek (malicious iOS app) hack — September 2026

FomoPeek, an iPhone app marketed as a read-only tool for watching large crypto transactions on Ethereum, Solana and Tron, shipped malicious code through Apple's App Store in versions 1.1 and 1.2, released on 9 and 12 September 2026, and has been linked to the theft of about $580,000 in USDT from people who installed it. The malicious modules were absent from the original release and were removed in version 1.3 on 17 September.

SlowMist, working with OKX's security team after receiving reports of stolen assets and exposed private keys, published its analysis on 20 September. It found two modules with no connection to the app's advertised functions: one communicated with remote command-and-control servers, and the other contained a kernel exploitation framework with eight attack methods chosen according to the iPhone model and iOS version. A successful exploit could escape the app sandbox, read and decrypt the Keychain and reach files belonging to other apps, including locally stored private keys and recovery phrases, without the victim connecting a wallet or typing anything in. The app and both modules were signed by the same Apple developer identity, which places the code inside the officially distributed app rather than in a copy altered later.

SlowMist identified a primary attacker address, active from 15 September, that had received 579,984.34 USDT across several networks, with funds still arriving when it published. Salus traced 401,028 USDT onward to FixedFloat, 20,000 USDT to a KuCoin hot wallet, 111,458 USDT through an escrow platform and 10,000 USDT through the CCE mixing service. The figure is a floor. Binance, OKX, Gate, Bitget Wallet and Rabby warned users to delete the app, update iOS and move their assets to wallets created on a device that never ran it, since removing the app does not invalidate keys that may already have been copied.