# FomoPeek iOS App Exploited for $580K Crypto Theft Malicious app used kernel exploits to bypass Apple's sandbox and steal wallet data. - **Source:** [Cointelegraph.com News](https://brifing.si/source/2e81e982-0137-4db0-8ac2-351f37085775) - **Published:** 2026-09-23 - **Topic:** [Data & AI](https://brifing.si/c/data-ai) - **Original article:** - **On Brifing:** https://brifing.si/s/62e17d26-8bc7-4dae-94f0-e005c376af8c ## Malicious app distribution The FomoPeek iOS app was distributed through Apple's official App Store, bypassing initial security checks. Researchers found it contained kernel-level exploits that allowed it to escape Apple's sandbox environment. This enabled unauthorized access to sensitive data from other apps, particularly cryptocurrency wallets. The malicious versions were released on September 9 and 12, 2026. ## Exploit framework details The app contained two malicious modules exploiting iOS vulnerabilities to gain elevated privileges. The exploit framework included eight distinct attack methods and supported iOS versions from 12.0 to 18.7.2 and 26.0 to 26.1. This broad version coverage increased the potential attack surface, allowing the malware to target multiple device configurations. ## Data access mechanisms The compromised app could access Keychain data and files belonging to other applications. This included sensitive wallet credentials and private keys stored by cryptocurrency apps. The sandbox escape technique represents a significant security breach in iOS's isolation architecture, which is designed to prevent such cross-app data access. ## Theft timeline and scale SlowMist's investigation revealed the primary hacker address received approximately 579,984 USDT (about $580,000). The address became active on September 15, shortly after the malicious versions were distributed. The theft involved multiple blockchain networks before funds were consolidated and laundered through various services. ## Fund movement patterns Stolen funds were transferred through services including FixedFloat, KuCoin, and cce.cash. Some funds were dispersed through additional addresses that investigators continued to trace. This laundering pattern suggests sophisticated operational security by the attackers to obscure the money trail. ## Collaborative investigation SlowMist conducted the investigation in partnership with OKX's security team after receiving reports from affected users. Analysis showed victims had installed the compromised FomoPeek versions prior to experiencing asset theft. The malicious components were removed in version 1.3 released on September 17. ## Industry response Apple had not responded to requests for comment at the time of reporting. The incident highlights challenges in maintaining app store security despite rigorous review processes. Security teams continue to monitor for similar exploitation attempts targeting iOS vulnerabilities. ## Security implications This breach demonstrates the evolving sophistication of mobile financial malware. The combination of App Store distribution and kernel-level exploits creates a potent attack vector. Users and developers must remain vigilant about app permissions and implement additional security layers for sensitive financial data. ## Sources covering this story - https://cointelegraph.com/news/fomopeek-ios-app-580k-crypto-theft?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._