SlowMist Links Malicious FomoPeek iOS App to $580K Crypto Theft

Security researchers have traced nearly $580,000 in stolen crypto to a malicious iOS application distributed through Apple’s App Store. According to an investigation by blockchain security firm SlowMist, the app—named FomoPeek—contained kernel exploitation capabilities designed to break out of Apple’s sandbox and reach sensitive wallet-related data.

SlowMist says the incident involved multiple attack modules that could elevate privileges and steal data stored by other apps, including items accessible via iOS Keychain mechanisms. The firm also tied onchain activity to a primary hacker address that received 579,984 USDT, with funds later routed across several services and networks.

Key takeaways

• SlowMist links the FomoPeek iOS app to about 579,984 USDT in stolen funds, based on onchain analysis.
• The malicious components were distributed in specific app versions released on Sept. 9 and Sept. 12, and removed in version 1.3 released Sept. 17.
• The exploit framework targeted iOS versions broadly (12.0 to 18.7.2 and 26.0 to 26.1) and included multiple methods for sandbox escape.
• SlowMist’s tracing indicates cross-network movement, followed by consolidation and transfers through intermediaries such as FixedFloat, KuCoin, and cce.cash.

What researchers say the app did

In its threat-intelligence analysis, SlowMist reports that FomoPeek introduced two malicious modules capable of exploiting iOS vulnerabilities. The firm describes how these components could help the app escape Apple’s sandbox environment, then gain elevated privileges to access sensitive data and files associated with other apps.

The report specifically highlights the ability to reach data stored in the Keychain, a common target for attackers looking to obtain credentials, tokens, or other secrets used by mobile applications. Once those privileges are gained, the scope of theft can broaden quickly—especially for users who already have crypto wallet software or related services installed on the same device.

Version timeline and what changed

SlowMist’s investigation provides a narrow window for when the harmful code was present. The firm says the affected FomoPeek versions were released on Sept. 9 and Sept. 12. It then points to a mitigation step: version 1.3**, released on Sept. 17, that removed the malicious components.

The detail matters for users and defenders because it implies the threat was not continuous across the entire app’s lifecycle. Instead, it appears tied to particular builds—meaning that devices running older versions would be at the highest risk, while later versions may have reduced exposure.

SlowMist also states that its work began after it received reports from users who said they experienced crypto theft and confirmed they had installed FomoPeek builds that fell within the affected period. The firm conducted the technical work together with the OKX security team.

Onchain trail: 579,984 USDT and cross-platform routing

To connect the iOS compromise to real-world losses, SlowMist performed onchain analysis. The firm says it identified a primary hacker address associated with the incident that received approximately 579,984 USDT.

SlowMist reports that this address became active on Sept. 15 and that the stolen funds were handled across multiple blockchain networks before being consolidated. From there, the flow continued through additional hops and addresses designed to obscure the trail.

In the report, SlowMist notes that portions of the funds were directed toward services including FixedFloat, KuCoin, and cce.cash. Other funds were dispersed across further addresses that the firm continued to trace.

While onchain movement cannot prove the full mechanics of the compromise by itself, it does provide a measurable link between the suspected attacker infrastructure and the ultimate transfer behavior. It also helps explain why such incidents often become multi-stage: initial theft on-device can be followed by rapid conversion, relocation, and consolidation efforts across chains and counterparties.

Targets, scope, and the exploit framework

SlowMist says the exploit framework used by FomoPeek included eight attack methods and claimed support for a wide range of iOS versions—specifically 12.0 to 18.7.2 and also 26.0 to 26.1.

That breadth is notable because iOS versions are not uniform, and exploit reliability can vary widely depending on device and patch level. A broader claimed range can indicate an attempt at wide applicability, which increases potential impact beyond a single narrow segment of users.

Still, the report’s most practical takeaway for users is not the list of supported versions—it’s the version-specific presence of the malicious code. If the harmful components were truly removed in version 1.3 on Sept. 17, that suggests updated installs could have helped limit damage going forward.

Cointelegraph attempted to request comments from Apple, SlowMist, and OKX, but did not receive responses before publication.

Readers should watch closely for follow-up disclosures from the security community and, most importantly, verify whether they have installed FomoPeek and which app version is currently on their devices. If a user still has any affected build installed, removing the application and updating to a later version would be a sensible immediate step, alongside reviewing wallet activity for any unusual transfers.