Have you ever downloaded a small utility on your phone because it looked harmless, then forgotten it was even there? That is the uncomfortable starting point of the latest scare hitting self custody holders. A third party iPhone and iPad app called FomoPeek, specifically builds 1.1 and 1.2, has been tied to malicious code that can reach far beyond the app itself. The warning from a major exchange wallet team is blunt: if that software ever sat on a device you use for crypto, treat the situation as a potential key leak, not a minor hygiene issue.
What Iphone Users Need To Know About FomoPeek
I have covered a lot of mobile wallet scams that rely on a fake icon and a panicked user typing a recovery phrase into the wrong screen. This case is different, and that difference matters. Researchers say the hostile modules inside those two versions were built to exploit the operating system, grab elevated privileges, and then look around the device. In plain language, the target is the phone, not one branded wallet app.
Once that kind of access exists, login details, chat logs, local files, and Keychain items become fair game. So do seed phrases and private keys if they were ever stored, cached, or typed on that handset. That is why the advice for self custody users is so severe: generate a new wallet on a clean device and move funds. Leaving coins on an address that may already be watched is wishful thinking.
If a program can leave the sandbox and read other apps, every secret on that phone should be treated as exposed until proven otherwise.
How The Warning Came Together
Community reports of drained wallets came first. Security teams then unpacked the binaries. Two modules inside versions 1.1 and 1.2 had nothing to do with the product’s advertised features. One of those modules carried a kernel exploitation framework with multiple attack paths. The framework could pick a method based on device model and system version. Coverage reportedly stretched from older iOS 12 builds through later 18.x releases, plus early 26.x builds. Older phones, as usual, sit in the higher risk bucket.
Version 1.0, pulled from official store history, did not contain those two frameworks. Version 1.1 introduced them. Version 1.2 kept them. Version 1.3 stripped them out. That timeline is ugly for a simple reason. The bad builds were not sideloaded junk from a random website. They went through the official store. I still think people underestimate how much false comfort that badge creates.
Why Escaping The Sandbox Changes Everything
Mobile operating systems are designed so one app cannot casually read another app’s files. That wall is the sandbox. Kernel exploits exist to punch through it. After a successful punch, malware can decrypt protected storage and walk through data that was never meant to be shared with a random utility.
Researchers also noted remote command channels that did not match the app’s public infrastructure. Operators could decide when exploits ran and how often. That is not a sloppy tracker. That is a controlled implant. Perhaps the most interesting aspect is the patience baked into that design. You do not need a splashy phishing page if you already live on the device.
- Remove FomoPeek and do not reinstall it.
- Update iOS to the newest available build.
- Assume credentials on that handset may be compromised.
- Create a new wallet on a device that never hosted the app.
- Move assets, then watch the old addresses for odd activity.
Who Should Panic And Who Should Just Clean House
Not every iPhone owner is in the same boat. If you never installed the app, this advisory is still useful as a reminder, not a personal emergency. If you installed 1.1 or 1.2 and you keep live seed material or hot wallets on that same device, you are in the urgent group. Exchange accounts logged in on the phone also deserve a password and session review, even if the chain keys themselves live elsewhere.
I have found that people delay the painful step. They tell themselves the app was only open for a minute. Attack code does not need you to stare at it. It needs a successful exploit and a path to storage. Minutes are enough.
A Practical Recovery Path For Self Custody
Use a separate phone, tablet, or computer that never had FomoPeek. Generate a fresh seed. Write it on paper or stamp it in metal. Do not screenshot it. Do not email it to yourself. Then send funds from the old wallet to the new address in sized chunks if that helps you stay calm, or in one move if fees and risk appetite allow. Confirm the destination on the device screen, not from a chat message.
If you already see unauthorized transfers, keep the infected device powered in a way that preserves logs, and contact support channels with evidence. Do not factory reset first if you still need forensic crumbs. That said, a reset is not a magic undo for keys that already leaked. Keys that left the device are gone from a secrecy standpoint. New keys are the only honest fix.
Clean recovery sketch: 1. Quarantine the old phone 2. Update or retire that OS 3. Birth a new seed on clean hardware 4. Sweep funds 5. Rotate passwords and app sessions
This Fits A Longer Pattern Of Mobile Wallet Theft
Phones remain the weakest room in the house for a lot of holders. Earlier spyware families hunted photos for handwritten seeds. Some campaigns used optical character recognition on camera rolls. Others shipped clone wallet apps that looked official enough to fool a tired person at midnight. A separate iPhone exploit kit described this year bundled multiple chains and hunted financial data after break-in. Different costumes. Same hunger for recovery phrases.
Fake wallet listings on official stores have also piled up. One clone wave this year included impersonations of well known desktop and hardware companion apps. Losses in individual cases ran from a handful of coins to seven figure sums. Those scams still need the victim to type the phrase. FomoPeek-style code tries to skip that conversation entirely. That is why I treat it as a step change, not just another headline.
Official Store Distribution Is Not A Character Reference
People love a shortcut: if it is in the store, it is safe. Reviewers catch a lot. They do not catch everything, especially when hostile code arrives in a point release after a clean first version. Attackers understand review windows. They ship polite software, collect users, then flip a switch in an update. You do not need a conspiracy lecture to see the incentive.
In my experience, the healthiest habit is boring. Limit what lives on the same handset as a hot wallet. Keep the seed off the camera roll. Prefer a dedicated device for large balances. Update the OS even when the popup is annoying. None of that is glamorous. It is how you avoid becoming a case study.
Technical Clues Without Turning This Into A Cookbook
Public writeups describe eight exploit methods inside the framework and version-aware selection. They describe Keychain decryption after privilege gain. They describe command-and-control traffic pointed at infrastructure that did not belong to the app’s public face. That is enough for a holder to grasp the severity. It is not a reason to publish exploit recipes. You do not need those details to decide whether to move coins.
What you do need is a sense of coverage. If your device is stuck on an old iOS branch because the hardware aged out of updates, your risk is higher across this whole class of bugs, not only this one app. Sometimes the grown-up move is to stop using that phone for custody work.
| Situation | Risk signal | First move |
| Never installed FomoPeek | Low for this incident | Still update iOS and review app list |
| Installed 1.0 only | Lower than 1.1 or 1.2 | Confirm version history, stay alert |
| Installed 1.1 or 1.2 | High if keys lived on device | New wallet on clean hardware, then sweep |
| Saw unexplained outflows | Active theft possible | Preserve evidence, rotate everything |
Hot Wallets, Photos, And The Quiet Ways Keys Leak
Most leaks are not cinematic. Someone photographs a paper backup “just in case.” A notes app holds a phrase. A cloud folder syncs screenshots. A browser saves a password next to an exchange login. Malware that can see the whole disk does not care which folder you thought was private. If the file exists, it is in scope.
That is also why “I only used a watch-only wallet” is not always a full defense. Watch-only setups are safer when the spending key never touched the phone. They are theater if you later imported the same seed to check a balance. Be honest with yourself about what that device has seen.
Exchange Accounts Still Need A Pass
Self custody is the loud part of this story. Custodial logins are the quiet part. If the same iPhone held exchange apps, email, and authenticators, rotate those too. New passwords. Fresh app passwords where available. Review devices and API keys. Withdrawal allowlists help after the fact only if the attacker has not already added an address. Check that list like you mean it.
I would rather overreact for a weekend than explain a drained account with “I was going to get to it.” Markets will still be there on Monday. Keys will not grow back.
What Teams Told Users In The Advisory
The public notice asked iPhone and iPad owners to check install history, delete the app, skip any reinstall of the bad builds, and move the operating system forward. Self custody users were told to stand up a new wallet on hardware that never touched FomoPeek and to transfer. Anyone spotting strange movement was asked to keep the device and records before opening a support ticket.
Create the new wallet somewhere clean. Then move the coins. Do not negotiate with a maybe.
– Practical custody rule after a device-level incident
How This Differs From Screenshot Stealers
Earlier mobile families loved camera rolls because humans are messy. They write seeds on paper, snap a photo, and feel organized. Optical character recognition turns that photo into text. Those campaigns are still out there. They are also easier to blunt: stop photographing secrets.
Kernel-level collection is harder to blunt with one habit. You can reduce the blast radius by keeping secrets off the phone. You cannot assume a single app permission toggle will save you after a sandbox escape. That is the uncomfortable lesson I keep coming back to.
A Note On Version Numbers And Human Memory
Most people cannot recite which build they installed two weeks ago. That is normal. Check purchase and download history in the store account. Check the device’s app list. If the name is there, or was there, act as if 1.1 or 1.2 might have run. The cost of that assumption is time. The cost of the opposite assumption can be the whole stack.
Version 1.3 removing the frameworks is good news for future downloads. It is not time travel. Code that already ran still ran.
Smaller Balances Are Not Automatically Safe
Thieves automate. Dusty wallets get swept when the pipeline is already built. I have watched people shrug because they “only” keep a few hundred dollars on mobile. That amount still pays for the operator’s next month of servers. It also trains you to be sloppy before the stack grows.
If you plan to ignore the migration because the number feels small, at least rotate the seed before you add more. Future you will not send a thank-you note if you skip that.
Hardware Wallets Are Not A Personality Trait
A signing device helps when the seed never entered the phone. It does not help if you unlocked the seed on the same iPhone to “check something.” Companion apps can also be phishing magnets, as clone listings keep proving. Pair hardware with discipline or you just own an expensive paperweight next to a compromised hot path.
- Confirm whether FomoPeek was ever present.
- Delete it and update the system.
- Inventory every wallet and exchange that touched the device.
- Rebuild custody on clean hardware.
- Move funds and monitor the old addresses.
What I Would Do Tonight If This Were My Phone
I would pull the phone off daily crypto duty. I would write down every app that holds money or mail. I would open a spare device, create new seeds, and start moving. I would change exchange passwords from a computer I trust. I would not argue with friends in a group chat about whether researchers “might be wrong.” They might. The downside of believing them is a boring evening. The downside of betting against them is irreversible.
Would I also feel annoyed that a store-listed app put me through this? Yes. Annoyance is not a security control.
Habits That Still Matter After The Headlines Fade
Keep the operating system current. Remove apps you do not use. Do not store seeds in photos, notes, or cloud docs. Separate high-value signing from the phone you use for social media. Treat unexpected wallet popups as hostile until proven kind. None of this requires a degree. It requires a refusal to be convenient at the exact moment convenience is expensive.
Mobile malware will keep chasing coins because coins move fast and victims feel the loss immediately. Some campaigns will look like games. Some will look like portfolio trackers. Some will look like this: a quiet update, a kernel trick, a remote switch. The names will change. The homework will not.
If you take one sentence with you, take this one. A wallet is only as private as the device that once touched its secrets. FomoPeek versions 1.1 and 1.2 are a reminder written in stolen funds. Check the phone. Move the keys. Then go back to living your life with a slightly more stubborn sense of what belongs on a pocket computer.
