Binance says App Store app FomoPeek could steal seed phrases from iPhones

Binance warned iPhone and iPad users on Sept. 19, 2026, that FomoPeek, an app distributed through Apple’s App Store, contained code researchers say could break out of iOS protections and reach wallet seed phrases, private keys and login data.

The FomoPeek malware presents a particular concern for crypto investors because the reported attack is not limited to a single wallet application. Binance said the incident should be treated as a device-level security issue rather than a conventional phishing attempt.

The exchange specifically urged users running iOS 26.x or earlier to determine whether they had ever installed FomoPeek. Users who meet both conditions were advised to remove the application, update their operating system and avoid reinstalling the software.

How the FomoPeek malware could access sensitive data

SlowMist’s investigation found that versions 1.1 and 1.2 contained components that were unrelated to the application’s advertised functions. Researchers working with the OKX security team identified an iOS kernel exploitation framework containing eight different exploit methods.

The framework was reportedly designed to select an exploitation method based on the affected device model and its iOS version. SlowMist said the framework covered a range of operating systems, including iOS 12.0 through 18.7.2 and iOS 26.0 through 26.1.

If the exploit succeeds, the FomoPeek malware could reportedly break through Apple’s application sandbox and gain access to protected information. Researchers said this could include Keychain data, private keys, wallet recovery phrases, login credentials, conversations and files belonging to other applications.

The investigation also identified communications between the malicious components and infrastructure unrelated to FomoPeek’s legitimate public services. According to the security analysis, those connections could allow remote instructions to be delivered to the compromised software.

SlowMist further reported that FomoPeek version 1.0 did not contain the two malicious frameworks. The components appeared in version 1.1, released on September 9, and remained in version 1.2, released on September 12. Security researchers said version 1.3, released on September 17, removed the identified frameworks.

The discovery is particularly notable because the affected versions were distributed through Apple’s official App Store, rather than being limited to unofficial or modified installations.

FomoPeek malware raises wider mobile security concerns

The FomoPeek malware is part of a broader pattern of attacks targeting cryptocurrency users through mobile devices. Security researchers have previously documented malware capable of searching smartphones for wallet recovery phrases, passwords and other information that can be used to access digital assets.

Earlier campaigns have included malware that searched photographs for recovery phrases. Other threats have relied on fake wallet applications designed to persuade users to enter their seed phrases directly into fraudulent software.

Rather than depending solely on a user voluntarily entering a recovery phrase, the malicious components identified by SlowMist were reportedly designed to exploit the operating system and access information belonging to other applications.

A compromised device can potentially expose information from multiple applications, increasing the consequences of a successful attack. Binance has therefore advised users to avoid applications from untrusted sources and keep device software updated.

What crypto investors should do after FomoPeek exposure

Investors who previously installed versions 1.1 or 1.2 of FomoPeek should treat the potential exposure seriously. Binance and SlowMist recommend removing the application and updating iOS to the latest available version.

For self-custody wallet holders, simply deleting the application may not be sufficient if sensitive credentials were already exposed. Binance recommends creating a new wallet on a separate device that has never had FomoPeek installed and transferring assets to the newly generated wallet address.

The FomoPeek malware warning also highlights why recovery phrases and private keys should not be stored casually on internet-connected devices. If a seed phrase has potentially been exposed, creating a replacement wallet with fresh credentials can limit the risk associated with the compromised information.

Users who discover unusual transactions or other unexplained asset movements have also been advised to preserve the affected device and relevant evidence before contacting Binance support.

The FomoPeek malware incident underscores a wider security challenge for crypto investors: protecting digital assets requires securing not only the blockchain wallet itself but also the devices used to access it.

As mobile applications become increasingly integrated with financial services, security researchers are likely to continue examining how vulnerabilities in smartphones can be exploited to reach cryptocurrency credentials.

For investors, the immediate lesson from the FomoPeek malware case is to verify installed applications, maintain current operating-system security updates and avoid relying on a compromised device for long-term custody of digital assets.

The FomoPeek malware investigation also demonstrates that an application appearing through an official software marketplace is not, by itself, an absolute guarantee against security risks.

Investors holding significant digital assets may therefore need to consider additional safeguards, including dedicated devices and carefully protected recovery credentials.