Malicious FomoPeek iPhone app linked to nearly $580,000 USDT theft through iOS exploits
SlowMist found malicious code in FomoPeek iPhone app versions; the exploit escaped the iOS sandbox, and a linked attacker wallet received 579,984.34 USDT.
Why it matters
FomoPeek users who expected a read-only tool could have other apps' Keychain data, files, private keys and seed phrases exposed, according to CryptoSlate, Cointelegraph and Bitcoin.com News. CryptoSlate said Binance, OKX, Gate, Bitget Wallet and Rabby warned users; the evidence does not establish wider market or regulatory effects.
Key facts
SlowMist and OKX security researchers found two malicious modules in FomoPeek versions 1.1 and 1.2 distributed through Apple's App Store.
Reported by CryptoSlate
FomoPeek presented itself as a read-only on-chain monitoring and alerting tool that did not require users to connect a wallet or provide a seed phrase.
Reported by CryptoSlate
The malicious code could bypass iOS protections, escape Apple's application sandbox and access Keychain data and files belonging to other apps, creating a potential path to locally stored private keys and seed phrases.
Reported by CryptoSlate
CryptoSlate reported that one module communicated with command-and-control infrastructure and the other contained a kernel exploitation framework with eight attack methods.
Reported by CryptoSlate
A controlled test found that the code collected Apple Notes data and uploaded it to a remote server.
Reported by Bitcoin.com News
CryptoSlate described the loss as nearly $580,000 in USDT, Cointelegraph put the primary attacker address at about 579,984 USDT, and Bitcoin.com News put a linked wallet at 579,984.34 USDT.
579,984.34 USDTDisputed figureReported by CryptoSlate
Versions 1.1 and 1.2 were released on Sept. 9 and Sept. 12, and version 1.3, released Sept. 17, removed the malicious components.
Reported by Cointelegraph
CryptoSlate said Binance, OKX, Gate, Bitget Wallet and Rabby warned users about the incident.
Reported by CryptoSlate
What happened
CryptoSlate, Cointelegraph and Bitcoin.com News reported that SlowMist and OKX security researchers found two malicious modules in FomoPeek versions 1.1 and 1.2 distributed through Apple's App Store. The app advertised read-only monitoring, but its code could bypass iOS protections, escape the application sandbox and reach Keychain data and files belonging to other apps. CryptoSlate reported that one module communicated with command-and-control infrastructure and the other contained a kernel exploitation framework with eight attack methods. Cointelegraph said the affected versions appeared on Sept. 9 and Sept. 12, while version 1.3, released Sept. 17, removed the malicious components; Bitcoin.com News reported that a controlled test collected and uploaded Apple Notes data. Cointelegraph put receipts at the primary attacker address at about 579,984 USDT, while Bitcoin.com News gave a linked-wallet figure of 579,984.34 USDT. None of the three reports states how many people were affected or whether the linked wallet received all stolen funds.
How the story developed
- Update
Primary attacker address became active
SlowMist said the address became active on Sept. 15.
- Resolution
FomoPeek removed malicious components
Version 1.3, released Sept. 17, removed the malicious modules.
- Update
SlowMist published threat analysis
Bitcoin.com News said SlowMist's analysis of the two malicious modules was published on Sept. 20.
- First report
First report by CryptoSlate
Rogue iPhone app escapes iOS sandbox to hijack $580,000 in USDT
- Independent corroboration
Independently corroborated by Cointelegraph
Malicious iOS app FomoPeek linked to $580K crypto theft, SlowMist says
- Update
Affected FomoPeek versions released
Versions 1.1 and 1.2 were released on Sept. 9 and Sept. 12, without an individual release date assigned to each version.
- Official statement
Official statement from Bitcoin.com News
iPhone Crypto App Hides Malicious Code as Attacker Wallet Nets $580K
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 22 Sept 2026, 22:50 UTC: CryptoSlate — 1 independent source, 1 reports
- 23 Sept 2026, 05:22 UTC: Cointelegraph — 2 independent sources, 2 reports
- 24 Sept 2026, 00:30 UTC: Bitcoin.com News, official — 3 independent sources, 3 reports
Affected entities
Also mentioned: Solana, TRON
Original sources
| Publisher | Report | Role | Published |
|---|---|---|---|
| Bitcoin.com News Company, official | iPhone Crypto App Hides Malicious Code as Attacker Wallet Nets $580K | Independent | |
| CryptoSlate Crypto media | Rogue iPhone app escapes iOS sandbox to hijack $580,000 in USDT | Original | |
| Cointelegraph Crypto media | Malicious iOS app FomoPeek linked to $580K crypto theft, SlowMist says | Independent |
Related events
Binance Adds Four USDT-Settled Stock Perpetuals, Each Capped At 20x
Bitcoinist reported Binance added USDT-settled perpetual contracts on StablecoinX, Viking Therapeutics, McDonald's and Akamai, each capped at 20x with no share delivery.
KuCoin Announces Multiple Service Updates Including API Symbol Changes, New Listings, and Trading Schedule in September 2026
KuCoin rolled out a series of service updates in September 2026 including ticker symbol changes, new token listings, trading pair launches, maintenance closures, and a VIP migration program.
Bitcoin Insider reports KuCoin CENT listing with 17,241,380 CENT giveaway
Bitcoin Insider reported that KuCoin listed Incentiv (CENT) on October 12, 2026 and ran a 17,241,380 CENT giveaway for traders.
NEAR Intents Says Exploiter Returned Full $3.8M After 48-Hour Ultimatum
NEAR Intents recovered the roughly $3.8 million taken in an Oct. 1 exploit of its Omni deposit infrastructure and closed its investigation, after naming the attacker and setting a 48-hour deadline.
KuCoin rolls out 5.0 platform upgrade with Unified Account for VIP users and advances Nigeria regulatory application
KuCoin launched its 5.0 upgrade with AI tools and a Unified Account for VIP users offering 300 USDT in fee coupons, while its Nigeria entity secured conditional SEC approval for a regulatory incubation programme.
KuCoin launches managed portfolio strategies with 100 USDT minimum deposit
KuCoin opened two managed portfolio strategies to eligible users with a minimum deposit of 100 USDT through its KuCoin Wealth platform.