Incident case file

FomoPeek Malicious iOS App Wallet-Drain Campaign

Incident date Sep 9, 2026Last updated Oct 8, 2026

2 views

ContainediOS malware targeting mobile wallet appsMalicious mobile appCluster: FOMOPEEK-IOS-2026-09

Estimated loss

$580.0K

Affected users

Group joining is coming soon.

Investigation

75%

Facts and investigation

Ledger

Attacker

0x6d37f2C5e8F8546b648D317295565dA95975f4BB (confirmed by Salus Security, cross-verified by Bitcoin.com News, CryptoSlate and Cointelegraph)

Funds moved to

Cash-out via an escrow-platform address, partly routed through the mixing service cce.cash, then onward through FixedFloat and KuCoin

Linked

Malicious code modules apptrace and libapptracecore were distributed in FomoPeek app versions 1.1/1.2 between September 9–17, 2026, with a hidden command-and-control channel hosted on Bitbucket. The app read the iOS Keychain and could extract credentials from 19 wallet apps including MetaMask and Trust Wallet. SlowMist has not disclosed an individual victim count; the $579,984.34 figure represents total receipts traced to the primary attacker wallet, not a confirmed total loss figure.

Chronology

1 beat

FomoPeek, a malicious iOS application, distributed trojanized versions (1.1 and 1.2) between September 9 and 17, 2026, embedding modules capable of reading the iOS Keychain and extracting credentials from 19 different mobile wallet applications. SlowMist and OKX issued a joint public alert on September 19, 2026. Salus Security subsequently traced approximately $579,984.34 USDT to a primary attacker wallet (0x6d37f2C5e8F8546b648D317295565dA95975f4BB), confirmed independently by three press outlets. Cash-out proceeded through an escrow-linked address, the cce.cash mixing service, and onward to FixedFloat and KuCoin. SlowMist has explicitly stated it did not break down individual victim losses, and no per-victim count has been published by any source.

Sources and coverage

Victim testimonies

No testimonies yet.

+ Add my testimony → (coming soon)