BlockBeats
Sep 26, 2026

BlockBeats apologizes for misreport on fomo App, says no paid smear campaign was involved

BlockBeats has issued a public explanation over an erroneous security report published on Sept. 23, 2026, at 19:38, when it pushed a story titled "fomo official iOS app contains crypto-stealing malware." The outlet said the app in question was actually called FomoPeek, not the widely used trading app fomo, and that its wording and push notification caused many readers to believe fomo users faced a theft risk. According to the statement, the mistake quickly spread across social media and triggered speculation that the article may have been a paid attack from a competitor, especially as overseas KOLs were at the same time criticizing trading losses on fomo. BlockBeats said it conducted an internal review and found no evidence of any paid smear arrangement. Instead, it concluded that the duty editor failed to verify the product name before republishing a security alert that had already been covered on Sept. 19. The outlet said it removed the incorrect article, updated the malware name to FomoPeek, stopped distribution of the wrong version across its homepage, search, and other channels, and disciplined the editor involved. It also said future reports involving security issues and specific product names will require a second round of verification before publication.

1220
BlockBeats apologizes for misreport on fomo App, says no paid smear campaign was involved
SlowMist
Sep 22, 2026

SlowMist and OKX say App Store-listed FomoPeek versions 1.1 and 1.2 carried an iOS exploit framework

SlowMist and the OKX security team said their joint analysis found that FomoPeek, an on-chain whale-tracking app distributed through Apple’s App Store, included a full iOS kernel attack framework in versions 1.1 and 1.2. According to the report, users did not provide mnemonic phrases and did not sign any transactions, yet their assets could still be stolen. SlowMist’s MistTrack data showed a main hacker address active since Sept. 15 that had received 579,984.34 USDT as of publication, with funds still flowing in. The researchers said the malicious components were shipped inside the official App Store builds rather than spread through re-signing or sideloading, and that the framework could communicate with attacker-controlled servers, exploit kernel flaws, escape the sandbox, decrypt Keychain data and collect information across apps. The report also said the command-and-control server targeted 19 wallet and note-taking apps, including Gate Web3, SafePal, OKX Wallet, MetaMask, Trust Wallet, imToken, TokenPocket, TronLink and Apple Notes. SlowMist advised users who installed versions 1.1 or 1.2 to treat old mnemonic phrases and private keys as compromised and move assets to a newly created wallet on a clean device.

1360
SlowMist and OKX say App Store-listed FomoPeek versions 1.1 and 1.2 carried an iOS exploit framework
ChainFeeds
Sep 22, 2026

ChainFeeds briefing highlights FomoPeek malware, Gen Z trading habits and Binance delisting rules

ChainFeeds’ Sept. 22 research briefing pulled together five separate pieces spanning tokenized equities, mobile wallet security, crypto market structure and exchange listings. One note argued that the market may be overstating the scope of the U.S. Securities and Exchange Commission’s innovation exemption for tokenized stocks, drawing a legal distinction between native or custody-backed tokenized equities and synthetic products that merely track names such as AAPL or NVDA. Another report, citing SlowMist, described how FomoPeek versions 1.1 and 1.2 on Apple’s App Store allegedly carried two malicious modules with remote configuration, exploit and cross-app data collection capabilities, and said 19 wallet and note-taking apps were included in collection targets. The same briefing also recapped a view from Noah Goldberg that reflexivity-driven alpha in crypto has not fully disappeared, even as AI compresses traditional forecasting edges. On the market side, Binance Research data cited by Cryptoslate showed Gen Z users were directing a larger share of stock allocations into unleveraged ETFs, trading less frequently than Millennials and Gen X, and behaving more like net accumulators than short-term speculators. IOSG Ventures, in a separate section, examined Binance’s 2026 delistings and argued that spot and derivatives operate under two very different survival filters, with FDV and open interest carrying more signal than raw trading volume.

1070
ChainFeeds briefing highlights FomoPeek malware, Gen Z trading habits and Binance delisting rules
FomoPeek
Sep 21, 2026

FomoPeek iPhone app linked to private key theft as nearly $580,000 in USDT is traced

Security researchers have identified malicious behavior in versions 1.1 and 1.2 of FomoPeek, an iPhone app distributed through Apple’s App Store, according to monitoring cited by Odaily and Bitcoin News. The researchers said the affected versions contained an iOS exploit framework capable of escaping the app sandbox and extracting keychain data, wallet files, and seed phrases. Blockchain security firm SlowMist linked the app to multiple theft cases and said it traced nearly $580,000 in stolen USDT to a main address. The finding raises concern for users who installed either of the two versions, because any keys accessible from the affected iPhone should be treated as compromised. The guidance cited in the report is direct: users who installed FomoPeek 1.1 or 1.2 should generate a new seed phrase on a clean device and move funds immediately. No additional loss figures or victim counts were disclosed in the source material.

970
FomoPeek iPhone app linked to private key theft as nearly $580,000 in USDT is traced
SlowMist
Sep 21, 2026

SlowMist says App Store-listed FomoPeek carried modules that could steal wallet data across apps

SlowMist said in a Sept. 20 report that FomoPeek, an on-chain monitoring app distributed through Apple’s App Store, included two malicious modules in versions 1.1 and 1.2 that could remotely fetch instructions, attempt kernel exploits, escape sandbox restrictions, decrypt Keychain data and collect information from other apps. The security firm said the case began after multiple users reported stolen assets and private key exposure, with some of the affected users having used those two versions before the thefts. According to the report, FomoPeek presented itself as a standard crypto tracking product. It had an App Store listing, a website, and an official X account, and marketed itself as a read-only whale tracker for Solana, Ethereum and TRON wallets that did not require seed phrases or wallet connections. SlowMist said its isolated testing retrieved a collection list covering 19 wallet and note-taking apps and captured an uploaded archive containing Apple Notes data. The report also traced one main attacker address analyzed by MistTrack. SlowMist said the address had been active since Sept. 15 and had received a cumulative 579,984.34 USDT by the time the report was published. Funds touched Ethereum, BNB Chain and Arbitrum, with part of the flow moving through FixedFloat and KuCoin. SlowMist advised users who had run FomoPeek 1.1 or 1.2 to treat related seed phrases, private keys and credentials as compromised and migrate assets on a separate trusted device.

6011
SlowMist says App Store-listed FomoPeek carried modules that could steal wallet data across apps
FomoPeek
Sep 20, 2026

SlowMist and OKX security team say FomoPeek iOS app carried malicious code

SlowMist TI and the OKX security team said a joint investigation found malicious code embedded in FomoPeek versions 1.1 to 1.2, linking the app to multiple cases involving leaked private keys and stolen assets. According to the findings, the app included a hidden module unrelated to its stated business functions, including an iOS kernel exploitation framework that could automatically choose attack methods based on device model and system version. The reported impact range covers iOS 12.0 to 18.7 and iOS 26.0 to 26.1. If the attack succeeds, the malicious app may break out of the iOS sandbox, obtain and decrypt Keychain data, read files from other apps, and steal sensitive information such as private keys, seed phrases, account credentials, chat records, and local files. Investigators also said FomoPeek connected to hidden servers unrelated to its public service and received remote commands. Captured plaintext traffic showed the attack functions were active and ran automatically on a regular basis, with older iOS versions facing relatively higher risk.

1340
SlowMist and OKX security team say FomoPeek iOS app carried malicious code
FomoPeek
Sep 20, 2026

FomoPeek theft case prompts renewed focus on private key security after alleged iOS exploit

A PANews article by the Biteye content team says the recent wallet drain incidents tied to FomoPeek have exposed a more aggressive attack path in crypto: users did not need to paste seed phrases into fake sites or sign obvious malicious transactions to lose funds. Citing a joint review by SlowMist and the OKX security team, the report says FomoPeek versions 1.1 to 1.2 allegedly bundled iOS kernel exploit code that could escalate privileges across different devices and system versions, escape the app sandbox, decrypt Keychain data, scan wallet information and notes stored on the same phone, and quietly send plaintext private keys back to an attacker-controlled server. The article frames the case as a shift from basic phishing to a broader social-engineering funnel built around KOL promotion, real product utility and referral incentives. It then lays out a five-part defense model for Web3 users: keep devices and operating systems clean and updated, never leave seed phrases in digital form, separate assets across cold, warm and hot environments, tighten token approvals and signature habits, and run a self-check before installing new apps or signing transactions. The piece argues that in a market where trust can be manufactured through social media distribution, private key protection now depends less on brand assumptions and more on strict operational discipline.

1070
FomoPeek theft case prompts renewed focus on private key security after alleged iOS exploit
SlowMist
Sep 20, 2026

SlowMist founder flags ComeCome app after FomoPeek wallet-theft attack

SlowMist founder Yu Xian said a food-delivery app called ComeCome, operating through comecome.icu, was found using a method similar to the earlier FomoPeek app poisoning incident. According to his disclosure, FomoPeek versions 1.1 to 1.2 contained a malicious SDK with eight iOS kernel exploit paths, allowing the code to choose an attack method based on device model and system version. Known affected iOS versions span iOS 12 to 18.7 and 26 to 26.1. Once the attack succeeds, it can break out of the iOS sandbox and steal assets from crypto wallets. Yu Xian also warned that the same kind of threat may extend to iPad and Mac devices. He advised users to update to the latest iOS release immediately and stay highly cautious about apps from unknown sources.

1010
SlowMist founder flags ComeCome app after FomoPeek wallet-theft attack
Total 12 items
Go topage