FomoPeek iOS app used a kernel exploit to steal crypto wallet keys

A wallet-tracking iPhone app called FomoPeek carried hidden code that could break out of Apple's application sandbox and steal private keys, seed phrases and login credentials, according to blockchain security firm SlowMist and OKX's security team. Binance has since warned iPhone and iPad users to remove the app.

What was found

FomoPeek presented itself as a read-only tool for watching large "whale" wallet movements on Ethereum, Solana and Tron. SlowMist's analysis of versions 1.1 and 1.2 found two modules unrelated to that stated purpose, one of which contained an iOS kernel-exploitation framework with several methods for exploiting different iPhone models and iOS versions, spanning iOS 12 through the 26.x line. Where exploitation succeeded, the app could escape the sandbox, decrypt Keychain data, and pull private keys, recovery phrases, login credentials and files belonging to other apps. Investigators found the code actively connecting to remote servers, not sitting dormant.

How it spread

Rather than App Store advertising, FomoPeek grew through crypto influencers, Telegram and Discord communities, and an invite-code referral reward. The offending frameworks were removed in version 1.3, released 2026-09-17, after the disclosures.

What MSP helpdesks should tell users

• Check installed apps for FomoPeek, or any unrecognized app, and delete it immediately.
• Do not reinstall it, even after the update — treat any device that ever had it as suspect.
• Update iOS to the current release; Apple's periodic patches close the underlying exploited bugs.
• If the device held wallet keys or seed phrases, create a new wallet on a separate, clean device and move funds, preferably to a hardware wallet.
• Escalate any related account or app-store fraud to the user's exchange or wallet provider.

For fleets that manage iPhones on behalf of customers, this is a reminder to keep mobile device inventories current enough to push an app-removal advisory quickly when a named risk like this surfaces.

Sources: crypto.news, CCN.