Nearly $580,000 in stolen USDT has been tied to FomoPeek, a malicious iPhone application distributed via Appleâs App Store.
Following reports of asset theft connected to exposed private keys, blockchain security firm SlowMist initiated an investigation into the application over the weekend.
Victims had previously downloaded versions 1.1 or 1.2 of FomoPeek, which was advertised as a read-only utility for monitoring substantial cryptocurrency transactions across the Solana, Ethereum, and Tron blockchains.
What is FomoPeek?
Upon collaborating with security experts at the OKX cryptocurrency exchange, SlowMist discovered two hidden modules within those versions that bore no relation to the app’s promotional monitoring features.
While one module communicated with external command-and-control servers, the other housed a kernel exploitation framework equipped with eight distinct attack methods capable of adapting to the user’s specific iPhone model and operating system version.
A successful exploit could bypass Apple’s application sandbox, gaining access to Keychain records and files belonging to other applications. This pathway exposed locally saved seed phrases, private keys, and login credentials without requiring victims to connect a wallet or manually input those details into FomoPeek.
Yu Xian, founder of SlowMist, noted that passwords maintained in Apple’s Keychain and encrypted documents held by third-party apps were equally vulnerable. Attackers securing both could potentially unlock wallet credentials alongside other sensitive data resident on the device.
He explained:
“After a successful attack, the app can break through the iOS sandbox isolation mechanism, then read and decrypt the system keychain (Keychain), and access data files from other apps on the device. Private keys, mnemonic phrases, login credentials, chat histories, files, and other user data stored on the device may all face the risk of leakage as a result. Additionally, the app connects to covert servers unrelated to its public business functions to receive remote instructions.”
The malicious elements were absent from the initial launch of FomoPeek. SlowMist detected them in version 1.1, deployed on Sept. 9, and version 1.2, released Sept. 12, prior to their removal in version 1.3 on Sept. 17.
Investigators additionally determined that the framework accepted directives from a remote server, including parameters dictating whether exploitation was active and the frequency of its execution.
Nearly $580,000 stolen
These technical discoveries aligned with an on-chain trail indicating that perpetrators had already transformed this access into financial losses.
Salus, a blockchain analysis company, pinpointed 0x6d37f2C5e8F8546b648D317295565dA95975f4BB as the perpetrator’s address, putting estimated proceeds from the event at roughly 579,900 USDT.
Out of that total, Salus tracked 401,028 USDT sent through three intermediary addresses to FixedFloat. An additional 20,000 USDT traveled across two transactions via deposit addresses before combining inside a KuCoin hot wallet.
Furthermore, 111,458 USDT traveled through an address linked by Salus to an escrow platform, while another 10,000 USDT moved via the CCE mixing service prior to landing at addresses connected to an escrow service.
Salus noted that its evaluation also suggested the collective behind the FomoPeek incident participated in a separate private-key theft back in June. Analysts are currently verifying if that prior strike utilized the identical methodology.
Crypto platforms warn users as custody debate returns
The extent of the losses and the potential breadth of the breach triggered alerts across multiple digital asset platforms, such as Binance, OKX, Gate, Rabby, and Bitget Wallet.
Binance cautioned:
“The third-party app FomoPeek (versions 1.1â1.2) contains malicious code that can exploit iOS system vulnerabilities to gain the highest level of device privileges, potentially accessing sensitive data stored on the device, including private keys, seed phrases, login credentials, chat history, files, and more. Please note that this type of malware targets the device itself. If an attack succeeds, data from all apps on the affected device may be accessed.”
In response, these virtual currency entities dispensed uniform advice, encouraging users to uninstall FomoPeek, update their iOS software, and transfer assets to newly generated wallets on untainted hardware.
These fresh credentials are required because merely deleting the software or updating the operating system fails to invalidate private keys that may have already been copied.
The incident concurrently surfaces two months after on-chain investigator ZachXBT proposed that a dedicated crypto iPhone might surpass traditional hardware wallets for safeguarding funds and approving transactions.
His suggestion depended on keeping the device completely isolated from general web browsing, messaging, and alternative tasks capable of expanding the attack surface.
FomoPeek highlights a distinct vulnerability within that approach. Designed specifically for crypto users and cleared by Apple’s official marketplace, the application nevertheless incorporated tools capable of breaching app isolation boundaries on the device.
This does not prove dedicated crypto iPhones are inherently less secure than hardware wallets, but it demonstrates that device isolation offers limited defense if installed software compromises the underlying operating system.
For impacted individuals, immediate efforts remain concentrated on stopping additional losses and following the stolen funds.
Salus continues tracking addresses holding the remaining assets, while Binance and other venues watch for incoming deposits that could grant investigators fresh avenues to monitor or freeze the pilfered USDT.
