FomoPeek
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·5ipSnB…geUSSummary
FomoPeek was an iOS App Store application marketed as a read-only cryptocurrency whale-wallet monitor. Versions 1.1 and 1.2, distributed September 9–12, 2026, were found by SlowMist and OKX security researchers to contain a hidden iOS kernel-exploit framework capable of sandbox escape, Keychain decryption, and data extraction from 19 other installed apps. Approximately $579,984 in USDT was traced to a single attacker-controlled address before the developer released a clean version 1.3 on September 17, 2026.
Connected Entities
1 entityNo connected entities recorded yet — this investigation is not currently linked to any other page in the index.
Timeline(7 events)
9 September 2026
FomoPeek version 1.1 (build 105) released on Apple App Store, introducing two malicious modules including an iOS kernel exploit framework.
Binance warning via crypto.news; Cointelegraph12 September 2026
FomoPeek version 1.2 (build 110) released, retaining both malicious modules.
Binance warning via crypto.news15 September 2026
Attacker-controlled address 0x6d37f2C5e8F8546b648D317295565dA95975f4BB became active, according to SlowMist and OKX on-chain tracing.
Cointelegraph17 September 2026
FomoPeek version 1.3 (build 111) released, removing both malicious frameworks. Malicious code was active for approximately eight days.
Cointelegraph; Binance warning via crypto.news19 September 2026
SlowMist and OKX security teams published joint findings identifying the malicious modules, tracing approximately $579,984 USDT to the attacker address, and issuing user advisories.
CryptoTimes; SlowMist on Medium19 September 2026
Binance issued a public advisory warning iPhone and iPad users to delete FomoPeek, update iOS, and migrate wallets to clean devices.
crypto.news22 September 2026
Apple removed FomoPeek from the App Store following emergency threat disclosure. Apple had not responded to press requests for comment as of Cointelegraph's publication.
Cointelegraph; search-aggregated reportingDecision Log
- hash: 9TT6LEkiFL5uJXqX1uB2vPcYvAiKsC8ADvMvAeBmnmZv
This investigation is cryptographically anchored to the Solana blockchain (1 event). 5 of 7 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 9/23/2026, 12:09:20 PM
last updated: 9/23/2026, 6:33:25 PM
1 viewavoid.net — verified advice for a post-truth world