On September 19, 2026, SlowMist posted a warning: they had been receiving multiple reports of stolen crypto assets, and the investigations all pointed to leaked private keys. The victims had one thing in common — they had installed FomoPeek, version 1.1 or 1.2.
SlowMist teamed up with OKX’s security team to take the app apart, and the conclusion was clear: malicious code was present.
FomoPeek markets itself as a whale-wallet tracker that monitors on-chain wallet activity on Solana, Ethereum and TRON. It sounds like a read-only market-watching tool — no transaction approvals, never touches your wallet — which is exactly why so many people felt safe installing it.
But once unpacked, beyond the normal business features, it carried two modules that had nothing to do with its stated purpose. One of them was an iOS kernel exploit framework bundling 8 different exploit chains, automatically picking one based on your device model and OS version.
The coverage was spelled out clearly: iOS 12.0 through 18.7, plus 26.0 through 26.1. That covers basically every iPhone released in the past several years.
iOS sandbox and Keychain, briefly
Sandbox: every iOS app is locked inside its own directory. It can only read and write its own slice of storage and cannot touch other apps’ data. This is the foundation of the “iPhone is secure” narrative — and the reason many people believe “installing a sketchy app can’t do much damage anyway.”
Keychain: the system’s key ring, where apps store passwords, tokens and encryption keys. It is encrypted, but the protection assumes the attacker never gets in. Once the kernel is compromised, that encryption is a door left half-open.
According to SlowMist, after a successful exploit the code could break out of the iOS sandbox, read and decrypt the system Keychain, and also access data files of other apps on the device.
What FomoPeek read
Per the list SlowMist published, the data at risk includes: private keys, seed phrases, login credentials, chat histories, and files stored by other apps. In other words — no matter which wallet app generated your private key, as long as it lived on this device, it was inside the framework’s reach.
SlowMist also noted that the older the iOS version, the higher the risk.
It was still taking remote orders
Besides stealing data locally, FomoPeek connected to several covert servers that made no sense for its public business, and used them to receive remote commands.
Plaintext communication captured by SlowMist shows the attack functionality was still active at the time, and it ran on a timer — not a one-shot job after install. When you open your wallet today, it may have just finished another round.
How it spread
For a new app to reach a large number of crypto users fast, organic growth is too slow. FomoPeek went with paid KOL referrals: KOLs promoted it with referral codes, new users who downloaded and registered with a code got 7 USDT, and the KOLs presumably earned more.
7 USDT isn’t much, but for a “just a market-watching tool that never asks for wallet permissions” pitch, it was reason enough. And the moment installation finished, the private keys on that device were no longer entirely yours.
If you installed it, do these things now
Here is the advice from SlowMist and OKX, ordered so you can follow it directly:
- Check your accounts and private keys for any unusual activity
- On a device confirmed never to have had FomoPeek installed, create a new account and generate a brand-new private key and seed phrase
- Move your assets to the new account as soon as possible
- Update this device’s iOS to the latest version
- Uninstall FomoPeek and never install it again
One thing bears repeating: uninstalling alone does nothing. A private key or seed phrase is just a string of characters — it doesn’t “live inside the app.” Deleting the app doesn’t invalidate the string that already leaked. Swapping the keys is the step that matters.
If you’ve already noticed unusual asset movement, keep the device and any evidence, and contact the official support of the affected platform right away.
This isn’t just a crypto problem
An app that made it onto the store while packing 8 kernel exploit chains means someone invested real money in this — it’s not a hobby project. Today it disguised itself as a wallet tracker; tomorrow it can be something else.
For the rest of us ordinary iPhone users, there’s really just one actionable takeaway: stop putting off system updates. And stop using “but it’s an iPhone” as a shield.
References
- SlowMist’s warning posted on X, September 19, 2026
- PANews: SlowMist warns of asset-theft risk in FomoPeek app versions 1.1–1.2