FomoPeek: The App Store App That Stole Crypto Through an iOS Kernel Exploit

On September 19, 2026, the security firm SlowMist, working with the security team at the exchange OKX, published an analysis of FomoPeek: an app that had passed Apple's review process, sat in the official App Store, and marketed itself as a safe way to track large cryptocurrency wallet movements. Inside it, researchers found code that had nothing to do with the app's stated purpose: a framework for exploiting the iOS kernel with eight distinct attack methods.

What the App Looked Like From the Outside

FomoPeek presented itself as a "read-only" tool: it claimed not to connect to wallets or require a seed phrase, only to monitor public on-chain data and alert users to large wallet movements, the kind crypto traders call "whale" activity. According to the researchers, the app did not grow organically. It spread through paid promotion from crypto key opinion leaders (KOLs), and new users who signed up through referral links received a 7 USDT reward. That is a distribution model plenty of legitimate crypto products use too, which is exactly why FomoPeek avoided suspicion for as long as it did.

The first version of the app really was clean. The problem came later, and that detail is what makes the FomoPeek case worth understanding: the malicious code was not baked in from day one. It was added after the product had already earned user trust and cleared the store's review.

Timeline: How the Code Appeared and Was Caught

Per SlowMist's analysis, version 1.1 (build 105) shipped on September 9, 2026, and already contained the two hidden malicious modules. Version 1.2 (build 110), released September 12, kept the same functionality. Only version 1.3 (build 111), released September 17, stripped both frameworks out of the code. The public warning went out on September 19, ten days after the first infected release.

That means for at least eight days, an app carrying a live kernel exploit was distributed through Apple's official store with no warning to users at all.

What the Malicious Code Actually Did

According to SlowMist's writeup, the embedded framework contained eight distinct iOS kernel exploitation methods capable of adapting to the specific device model and OS version in use. The affected range, per the investigation, spanned iOS 12.0 through 18.7, plus the newer 26.0 and 26.1 builds, with older iOS versions carrying a higher risk.

On a successful run, the code could escape the app's sandbox, gain elevated privileges, and decrypt the contents of the system Keychain, where iOS stores passwords, tokens, and cryptographic keys. From a compromised device, an attacker could in theory pull private keys, seed phrases, login credentials, messaging app data, and files belonging to other apps entirely, not just FomoPeek.

One detail worth noting: the developers built the code to trigger not on every launch but at recurring intervals, which made the threat harder to catch through ordinary traffic and behavior analysis.

How It Cleared Apple's Review

The App Store's review process is weighted toward scrutinizing an app's first release; later updates often go through a lighter or partially automated check, especially once a developer has a track record of approved releases. FomoPeek exploited exactly that gap: the clean first version earned trust, and the malicious code arrived in an update. That pattern is known as app store poisoning, and it isn't new. What makes FomoPeek notable is the scale of the tooling packed into it: eight kernel exploitation methods in a single update is a level of investment usually associated with targeted, state-level attacks rather than mass-market malware.

The Scale of the Incident

SlowMist and the outlets that covered the investigation have not disclosed a precise dollar figure for losses or a total count of infected devices. What is known is that some users reported their wallets emptied after installing the app. That absence of hard numbers shouldn't be read as an absence of damage; it's typical of an early-stage investigation, not a sign the incident was small. Binance issued a separate warning to iPhone users, advising anyone who had installed the app to treat their device as already compromised.

If You Installed FomoPeek

The first and most important point: deleting the app does not fix the problem. If the Keychain was compromised, any keys or seed phrases it held should be treated as exposed, whether or not the app is still on the phone. The standard advice from security researchers, including Binance's own guidance, is to generate new wallets only on a device that has never run FomoPeek, then move all assets off the old addresses.

The sequence matters. Start by updating iOS to the latest available build; some of the exploits in the set are already patched for current versions. Then, on a separate device you're confident is clean, use a proper wallet recovery process, generate new addresses, and transfer everything off the old wallets, including funds that had nothing to do with the app directly if they were stored on the same compromised iPhone. Change the passwords and two-factor codes for any service the Keychain could have had access to. And if a transfer to an attacker's address has already happened, record the addresses and the timing of every suspicious transaction before doing anything else.

If Funds Are Already Gone

As with most crypto theft cases, the rule here is that speed matters more than almost anything else. Stolen funds move through a chain of intermediate addresses before landing on an exchange where a freeze request becomes possible. The job of blockchain tracing in this kind of case is to build the transaction graph from the theft to the cash-out point and identify which exchange the funds reached, so a request can go out before the attacker has a chance to cash out.

"App store poisoning isn't a new technique, but packing eight kernel exploitation methods into a single update signals serious investment by the attackers. For users, the takeaway is simple: an app being on the official store, and being actively promoted in crypto circles, is no longer a guarantee that your seed phrase is safe."

The FomoPeek case is a good reason to reconsider basic crypto storage hygiene. Any app requesting access to system-level device data deserves scrutiny, even one officially approved by the store and heavily promoted within the crypto community. Larger balances are safer on hardware wallets that stay physically isolated from a smartphone and its Keychain.

How to Protect Yourself Going Forward

FomoPeek is not the first App Store poisoning campaign to target crypto users. Researchers have pointed to similar cases, including the widely reported SparkKitty malware, which targeted seed phrases stored as screenshots in a phone's photo gallery. The pattern across these campaigns is consistent: instead of attacking a wallet directly, they compromise the device the wallet lives on.

For iPhone users holding crypto, the practical takeaways are straightforward. Keep larger balances on a hardware wallet that stays physically separate from the phone and its Keychain. Only install apps from developers with a transparent, verifiable track record, not just an active influencer marketing push. Review the list of apps with system-level permissions on your device periodically and remove anything you no longer use. And remember the core rule: no legitimate wallet-tracking app needs access to the Keychain or to other apps' data, so a request for that kind of permission is itself a red flag worth taking seriously.