Binance has warned iPhone and iPad users to check whether they installed FomoPeek after security researchers linked versions 1.1 and 1.2 of the application to malicious code capable of exposing cryptocurrency wallet credentials and other sensitive information stored on affected devices. The warning followed disclosures from the security community and findings from blockchain security researchers, including SlowMist, which investigated reports involving stolen assets and private key exposure.
According to Binance, the risk extends beyond a single crypto application because the malware targets the device itself. A successful exploit could potentially expose private keys, seed phrases, login credentials, chat records and locally stored files belonging to other applications. That distinction makes the incident more serious than a typical fake wallet scheme that relies on convincing a user to manually enter recovery information into a fraudulent interface.
Binance advised users who installed FomoPeek and are running iOS 26.x or an earlier version to remove the application, avoid reinstalling it and update their operating system to the latest available version. Self custody wallet users were also told to create new wallets on a separate device that has never had FomoPeek installed and move assets to those new addresses.
SlowMist Found Exploit Modules Inside FomoPeek Versions 1.1 and 1.2
SlowMist provided more technical detail after receiving multiple reports of stolen assets involving private key exposure. Working with the OKX security team, researchers identified two modules inside FomoPeek versions 1.1 and 1.2 that were unrelated to the application’s advertised functions. One of those modules contained an iOS kernel exploitation framework equipped with eight exploit methods.
The framework could select an attack method according to the device model and operating system version. Researchers said its declared coverage included iOS 12.0 through 18.7.2 and iOS 26.0 through 26.1, while older iOS versions generally faced a higher level of risk. Once an exploit succeeded, the malicious code could escape the normal iOS sandbox and obtain elevated access to information stored elsewhere on the device.
That access could include decrypted Keychain data and files belonging to other applications. SlowMist said this could expose cryptocurrency private keys, wallet recovery phrases, account credentials, conversations and locally stored files. The ability to move beyond FomoPeek’s own application environment is central to the security concern because it means potentially sensitive information held by unrelated apps could also be affected.
Researchers also found that the malicious code communicated with infrastructure unrelated to FomoPeek’s public services. Analysis of those communications indicated that operators could remotely control exploit execution and determine how frequently the process ran.
The Malicious Code Appeared in Specific App Store Versions
Historical versions obtained through Apple’s official App Store helped researchers identify when the malicious frameworks appeared. SlowMist found that FomoPeek version 1.0 did not contain the two suspicious frameworks. Version 1.1, build 105, introduced them on Sept. 9, while version 1.2, build 110, retained the malicious code after its Sept. 12 release.
Version 1.3, build 111, removed both frameworks on Sept. 17, according to the investigation. The affected versions had been distributed through Apple’s official App Store rather than through third party stores or re-signed installations. That detail is significant because it shows that the malicious versions were not limited to unofficial distribution channels.
Binance’s instructions focused on users who had installed the affected app. The exchange recommended removing FomoPeek, avoiding reinstallations and keeping device software updated. Users who notice unusual asset activity were advised to preserve the affected device and relevant evidence before contacting customer support.
For self custody users, both Binance and SlowMist recommended creating a new wallet using a trusted device on which FomoPeek had never been installed. Users should generate a new private key and seed phrase on that clean device, then transfer assets from wallets that may have been exposed through versions 1.1 or 1.2.
Mobile Crypto Malware Has Used Several Different Techniques
The FomoPeek findings come after other mobile malware campaigns targeted cryptocurrency users through different methods. In July, crypto.news reported on SparkKitty, mobile spyware capable of collecting images from infected iOS and Android devices and sending them to servers controlled by attackers.
Kaspersky had detailed SparkKitty in June 2025 after identifying infected applications distributed through Apple’s App Store, Google Play and unofficial channels. The malware searched for wallet recovery phrases, passwords and other sensitive information that users had stored as images on their phones.
An earlier malware family known as SparkCat used optical character recognition to scan images for cryptocurrency recovery phrases. Some infected applications carrying the malicious software reached official app stores, while Kaspersky said the campaign had been active since March 2024.
Researchers have also documented attacks that did not depend on users storing recovery phrases in screenshots. In March, Google’s Threat Intelligence Group identified an iPhone exploit kit called Coruna. The framework contained five complete exploit chains and 23 vulnerabilities and targeted devices running versions between iOS 13 and iOS 17.2.1.
According to Google’s researchers, Coruna could search compromised iPhones for cryptocurrency wallet recovery phrases and financial information. The toolkit had moved through different groups over time, including financially motivated cybercriminals.
Fake Wallet Applications Have Also Reached Apple’s App Store
Crypto users have faced another category of mobile threat involving applications that impersonate legitimate wallet software. In August, a fake Wasabi Wallet application appeared on Apple’s App Store and was linked by security monitoring reports to the theft of roughly 6 BTC from one victim.
At the time, the fraudulent listing was identified as the 27th reported crypto wallet clone found on the App Store during 2026. A fake Ledger application represented the largest reported case among those clones, with roughly $9.3 million stolen.
Another fake Ledger Live application had previously been linked to the loss of 5.9 BTC worth roughly $420,000 from American musician Garrett Dutton, professionally known as G. Love. Dutton downloaded software posing as the Ledger Live manager onto a new MacBook Neo and entered his recovery phrase into the fraudulent application.
Blockchain records later showed the stolen Bitcoin moving to several deposit addresses associated with the KuCoin exchange. That type of impersonation attack depends on convincing a victim to manually provide recovery information.
FomoPeek differs from those cases because SlowMist described malicious code capable of exploiting the operating system, gaining elevated privileges and collecting information from other applications without relying solely on a user entering a seed phrase into a fake wallet interface.
Earlier Malware Campaigns Show the Scale of Wallet Credential Theft
SlowMist has previously investigated other malicious applications that obtained wallet information directly from user devices. In February 2025, the firm reported that a fake application called BOM had compromised more than 13,000 wallets across Android and iOS, with estimated losses exceeding $1.82 million.
According to that investigation, BOM requested access to files, photos and media before scanning device storage for private keys and mnemonic phrases and transmitting the information to a remote server. Onchain analysis linked the main attacker address to stolen assets moving across BNB Chain, Ethereum, Polygon, Arbitrum and Base.
The affected cryptocurrencies included USDT, Ethereum, Wrapped Bitcoin and Dogecoin. The case illustrated how mobile applications can target wallet data directly when sensitive information is accessible on a device.
FomoPeek represents another variation of that threat model. Instead of depending only on permissions or user deception, the malicious versions contained exploit frameworks designed to obtain higher system privileges. That capability could potentially expose data beyond the application itself and makes the incident relevant to users who may have assumed that information stored in other apps remained isolated.
What Binance and SlowMist Advised FomoPeek Users to Do
For users who installed FomoPeek versions 1.1 or 1.2, the central recommendation is to treat potentially exposed wallet credentials seriously. Binance advised affected users to uninstall the app, avoid reinstalling it and update iOS to the latest available version.
Self custody users were told to create a new wallet on a separate trusted device that had never run FomoPeek. The new wallet should use newly generated private keys and seed phrases, after which assets from potentially exposed wallets can be transferred to new addresses.
SlowMist similarly recommended checking accounts for unauthorized activity and generating new wallet credentials on a trusted device. Users who detect unusual asset movements should preserve relevant evidence rather than immediately discarding the affected device, according to Binance.
The incident also reinforces the security risk created when malicious software reaches official application stores. FomoPeek versions 1.1 and 1.2 were distributed through Apple’s App Store, while previous malware and fake wallet applications have also appeared through official channels.
SlowMist’s findings also explain why the recommended response goes beyond deleting the application. If private keys or recovery phrases were exposed, removing FomoPeek does not change credentials that may already have been compromised. That is why Binance and SlowMist directed self custody users toward new wallets created on unaffected devices. The emphasis on preserving evidence in cases of unusual activity also reflects the need to keep the compromised device available for further review. Binance advised users to keep device software current and avoid applications obtained from untrusted sources, while the FomoPeek case showed that official distribution alone did not prevent malicious versions from reaching users.
The immediate concern remains focused on users who installed the affected FomoPeek versions. The security findings show that mobile wallet threats can extend beyond fake interfaces and malicious permissions into operating system exploitation capable of reaching sensitive information across a device.
