Binance warns iPhone users of FomoPeek malware targeting crypto wallets

Binance has warned iPhone and iPad users to check whether they have installed FomoPeek after security researchers linked versions 1.1 and 1.2 of the app to malicious code capable of exposing private keys, seed phrases and other data stored across affected devices. Summary Binance has warned iPhone and iPad users after malicious code was discovered in FomoPeek versions 1.1 and 1.2. The malware could exploit iOS vulnerabilities to access private keys, seed phrases, login credentials and data stored by other apps. Affected self custody users were advised to create new wallets on clean devices and transfer their assets to the new addresses. According to Binance, the warning follows a security incident disclosed by the community and findings from blockchain security firms including SlowMist, which found that the affected FomoPeek versions could exploit vulnerabilities in Apple’s iOS operating system and obtain high level privileges on a device. ⚠️ Security Advisory | iPhone Users: Check Whether You’ve Ever Installed the FomoPeek App Binance is aware of a security incident recently disclosed by the community. According to security firms including SlowMist, the third-party app FomoPeek (versions 1.1–1.2) contains… pic.twitter.com/DwLwHIBVB2 — Binance Wallet (@BinanceWallet) September 19, 2026 The malware targets the device itself instead of a specific crypto application, Binance said. A successful attack could therefore expose information held by other apps, including login credentials, chat records and files alongside cryptocurrency wallet data. Users who have installed FomoPeek and run iOS 26.x or an earlier version should remove the application, avoid reinstalling it and update their operating system to the latest available version, according to Binance. Self custody wallet users were advised to use a separate device that has never had FomoPeek installed to create a new wallet and transfer their assets to the new address. Binance asked anyone who detects unusual asset activity to preserve the affected device and relevant evidence before contacting customer support. FomoPeek malware could escape the iOS sandbox SlowMist’s investigation provided more detail on how the malicious versions operated after the security firm received multiple reports of stolen assets involving private key exposure. Working with the OKX security team, researchers found two modules inside FomoPeek versions 1.1 and 1.2 that were unrelated to the application’s advertised functions. One contained an iOS kernel exploitation framework equipped with eight exploit methods, allowing it to select an attack method based on the device model and operating system version. You might also like: Binance Wallet opens tokenized pre-IPO access The framework’s declared coverage included iOS 12.0 through 18.7.2 and iOS 26.0 through 26.1, according to the researchers. SlowMist said older versions of iOS generally faced a higher level of risk. Once an exploit succeeded, the malicious code could escape the iOS sandbox, decrypt Keychain data and access files belonging to other applications.