Crypto Users Warned After FomoPeek iOS App Exposes Private Keys
Crypto users who installed FomoPeek versions 1.1 or 1.2 on an iPhone or iPad are being urged to secure their wallets after researchers discovered malicious code capable of exploiting iOS and accessing sensitive device data.
Summary:
- FomoPeek 1.1–1.2 contains malicious code targeting iOS devices.
- The malware can expose private keys, seed phrases and other sensitive data.
- Affected users should create a new wallet on a clean device and move their assets.
SlowMist issued the warning on September 19 after receiving multiple reports of stolen crypto assets involving private-key exposure.
A joint investigation with the OKX security team found two suspicious modules inside FomoPeek that were unrelated to the app’s advertised functionality.
One contained a kernel exploitation framework with eight different attack methods. SlowMist said the malware could select an exploit based on the device model and iOS version, with its analysis covering iOS 12.0–18.7 and iOS 26.0–26.1.
The findings are particularly serious for crypto users because the attack targets the security of the device rather than relying on a malicious wallet approval or a user voluntarily entering a seed phrase.
FomoPeek Can Escape Apple’s Normal App Isolation
Under Apple’s security architecture, third-party iOS apps operate inside individual sandboxes designed to stop them from accessing information stored by other apps or modifying the operating system. Apple also states that normal app APIs do not allow applications to escalate their own privileges.
SlowMist’s analysis indicates that FomoPeek was built to circumvent those protections.
If one of the embedded exploits succeeds, the malicious code can obtain elevated access, escape the application’s sandbox and potentially access or decrypt Keychain information. Researchers identified private keys, recovery phrases, login credentials, chat histories and files belonging to other applications among the data potentially exposed.
Apple’s Keychain is used to protect sensitive information including website and app passwords, passkeys and other account credentials.
The investigation also found that FomoPeek communicated with servers unrelated to its public services and could receive remote instructions. SlowMist said captured plaintext traffic indicated that the malicious functionality was enabled and configured to execute automatically at regular intervals.
Neither SlowMist nor OKX has disclosed the total amount of cryptocurrency stolen or the number of devices successfully compromised.
What FomoPeek Users Should Do Now
Removing the application is important, but it cannot revoke a private key or seed phrase that may already have been extracted.
SlowMist, OKX and Binance therefore recommend replacing potentially compromised wallet credentials rather than continuing to use the same addresses.
1. Remove FomoPeek
Delete the application and do not reinstall it. Users should also review wallet history for withdrawals or transfers they do not recognize.
2. Create a wallet on a clean device
Generate a completely new wallet, private key and recovery phrase on a trusted device that has never had FomoPeek installed. A hardware wallet can also keep newly generated signing keys separate from the affected phone.
3. Move remaining crypto
Transfer remaining assets from addresses whose keys may have been stored on the affected device to the newly generated addresses. Reusing the old seed phrase in another wallet application does not solve the problem because the underlying credentials remain the same.
4. Update and secure the affected device
Binance recommends updating the affected iPhone or iPad to the latest available iOS version.
For users concerned that malicious software remains on the device, Apple documents a more thorough option: restoring the device to factory settings. Apple specifically warns that when a reset is performed because malicious software may have been installed, restoring from a backup could reinstall the software the user was trying to remove.
READ MORE: Trezor Hit by Third Vendor Breach as Hackers Send Legit-Looking Emails
Apple guidance for restoring a potentially compromised device
Users who have already detected unauthorized transfers should preserve relevant records and evidence before wiping the affected device.
Why Deleting the App Does Not Secure an Exposed Wallet
A private key controls authorization over assets at its blockchain address. Once an attacker obtains that key, removing the malware from the phone does not remove the attacker’s copy.
The same applies to a recovery phrase. Importing the old phrase into a clean phone or another wallet simply recreates the same compromised keys.
The security boundary therefore has to move to new cryptographic credentials generated in a trusted environment.
This is also why the incident is more serious than an ordinary malicious-app warning. Apple’s sandbox normally prevents one third-party application from reading another application’s private files. A successful kernel-level exploit can break that isolation and expand the potential exposure beyond information entered directly into FomoPeek.
The investigation currently applies specifically to FomoPeek versions 1.1–1.2. SlowMist and OKX have linked the affected versions to reports of asset theft, but no comprehensive victim count or total financial loss has been released.
For users who installed those versions, the practical distinction is straightforward: deleting FomoPeek removes the application, while generating new keys and moving the assets removes reliance on credentials that may already be in an attacker’s possession.
The information presented in this article is intended for informational purposes only and should not be interpreted as financial, investment, or trading advice. Coinspress.com does not promote or advocate for any particular investment strategy, asset, or cryptocurrency project. Cryptocurrency markets are highly volatile and unpredictable – always perform your own research and seek guidance from a qualified financial professional before making any investment decisions.
Alexander Stefanov
Reporter at CoinsPress
Alex is Editor-in-Chief of Coinspress and co-founder of Millennial Media Group, with nearly a decade of experience covering financial markets - crypto first, then everything else. It started in 2016 with Bitcoin. Like most people at the time, he didn't fully understand it - so he kept digging. Blockchain, tokenomics, the projects, the cycles. That curiosity never stopped, and eventually pulled him into traditional markets too: equities, commodities, macro. Not because he left crypto behind, but because you can't properly understand one without the other. What drives him is straightforward: he wants to know why something is happening, not just that it's happening. Most market coverage stops at the headline - price up, price down, here's a chart. Alex finds that kind of reporting actively unhelpful. If you walk away from an article without understanding the mechanism behind the move, what did you actually learn? He holds a degree in Tourism from New Bulgarian University - not the most obvious path into financial markets, but markets have a way of pulling in people who are simply too curious to stay out. He has authored over 200 in-depth analyses and more than 10,000 articles across crypto and traditional finance. He still thinks every day in markets teaches him something new. That's probably why he hasn't stopped.
