FomoPeek app stole nearly $580K USDT on iOS

Blockchain security firm SlowMist has traced approximately 579,984 USDT in stolen cryptocurrency to kernel exploits embedded in FomoPeek, an iOS application that bypassed Apple's sandbox protections to extract wallet credentials and private keys from users' devices.

The compromised builds, released through Apple's official App Store on Sept. 9 and Sept. 12, deployed two modules engineered to exploit iOS kernel vulnerabilities and elevate system privileges. Once active, the malware accessed Keychain entries and application files across the device. Apple approved version 1.3 on Sept. 17, which no longer contained the attack code.

SlowMist opened its inquiry alongside OKX's security unit after multiple theft reports surfaced from individuals who had installed the malicious releases. Technical analysis revealed an exploit framework supporting eight distinct attack vectors, compatible with iOS builds spanning 12.0 through 18.7.2 and 26.0 to 26.1.

On-chain tracing identified a principal receiving address that began operations on Sept. 15. Stolen assets moved across several blockchain networks before consolidation. Investigators documented outbound transfers to FixedFloat, KuCoin and cce.cash, with remaining balances dispersed to addresses still under active monitoring.

According to Cointelegraph, Apple and OKX had not responded to the outlet’s requests for comment before its article was published.