Key Insights:
- New iPhone Fomopeek malware emerges targeting crypto users.
- Binance and other security experts have warned against this bug.
- The bug allows malicious attackers to steal iPhone users’ assets by accessing all app files on the device.
Blockchain security company SlowMist uncovered malicious software targeting cryptocurrency users within the iOS application FomoPeek. The organization issued a warning to iPhone owners on September 19, pointing out that multiple individuals had reported asset thefts.
SlowMist reported that its findings indicate victims suffered exposed private keys, with investigations revealing that several victims had downloaded FomoPeek version 1.1 or 1.2.
FomoPeek markets itself as a read-only tool designed to track whale wallets across the Ethereum, Solana, and Tron networks. The application monitors these whale wallets and transmits
FomoPeek Malware Capable of Bypassing iOS Sandbox
The security organization pointed out that the application’s iOS build includes two components that serve no legitimate purpose for its stated function. One of these components houses an iOS kernel exploitation framework featuring eight distinct methods for targeting iOS.
The issue impacted iOS versions 12.0 – 18.7 and 26.0 – 26.1, with the framework automatically choosing an exploit technique tailored to the specific iPhone model and operating system version. When successful, the software breaks out of the iOS sandbox to decrypt confidential keychain data and reach other application directories.
Consequently, virtually all confidential data stored on the handset faces exposure risks, encompassing login details, seed phrases, messaging logs, private keys, and additional sensitive records.
Furthermore, the FomoPeek application can harvest information and establish connections with stealth servers. Malicious operators are also capable of transmitting remote commands to the software. Nonetheless, the malicious code appears to have been purged, seeing as version 1.3 of the application—released on September 17—omits these frameworks entirely.
Binance Urges Users to Move Assets, Uninstall FomoPeek, and Update iOS
A number of digital asset exchanges have already issued warnings regarding the event. Binance instructed iPad and iPhone customers operating iOS version 26.x or prior who downloaded the software to delete it immediately and refrain from reinstalling it.
The exchange additionally advised these individuals to upgrade their iOS operating system to the newest release, though it noted that no Binance customers had reportedly been impacted.
Regarding its proprietary self-custody wallet, the platform advised users to transfer their funds to a fresh wallet housed on hardware that never interacted with FomoPeek.
Additional trading platforms, such as Gate.io and OKX—both of which aided SlowMist during the inquiry—have likewise issued advisories to their client bases.
This event underscores how malicious operators persist in targeting cryptocurrency holders via handheld technology. Throughout recent years, threat actors have progressively utilized diverse strategies to compromise mobile hardware and infiltrate digital wallets.
Significantly, these dangerous applications periodically surface on official distribution platforms like the Google Play Store and Apple App Store. Multiple fraudulent cryptocurrency programs have previously surfaced on the App Store, such as a counterfeit Wasabi wallet that resulted in a user losing 6 BTC during August.
This article is for informational purposes only. Users who may have installed affected software should follow guidance from official security providers and wallet platforms.