iPhone app escaped iOS sandbox; $580k in USDT stolen

FomoPeek, an iPhone app distributed through Apple’s App Store, contained hidden exploit modules in versions 1.1 and 1.2 that allowed attackers to access device keychains and private keys and to steal about 579,900 USDT. The covert components were added on Sept. 9 and Sept. 12 and were removed in version 1.3, published on Sept. 17.

Blockchain security firm SlowMist opened the investigation after reports of stolen assets and worked with security researchers at OKX to analyze the app. They found two covert components: one that communicated with external command-and-control servers and a kernel-exploitation framework with eight attack methods that adapt to the victim’s iPhone model and iOS version.

The exploit could escape Apple’s app sandbox and read or decrypt the system Keychain and data files belonging to other apps. That created a path to locally stored private keys, mnemonic phrases, login credentials, chat histories and files without users ever connecting a wallet to FomoPeek. The framework could also receive remote instructions controlling whether and how often exploitation ran.

SlowMist founder Yu Xian warned, “After a successful attack, the app can break through the iOS sandbox isolation mechanism, then read and decrypt the system keychain (Keychain), and access data files from other apps on the device. Private keys, mnemonic phrases, login credentials, chat histories, files, and other user data stored on the device may all face the risk of leakage as a result.”

On-chain analysis by Salus traced the proceeds to an attacker address and estimated total losses at about 579,900 USDT. Salus traced 401,028 USDT through three intermediary addresses to the FixedFloat service, 20,000 USDT through deposit addresses into a KuCoin hot wallet, 111,458 USDT via an address linked to an escrow platform and 10,000 USDT through the CCE mixing service. Salus mapped cross-chain links between Ethereum and TRON and reported the group may have been involved in a separate private-key theft in June; investigators are still determining if the same technique was used.

Crypto platforms including Binance, OKX, Gate, Bitget Wallet and Rabby warned customers to remove FomoPeek, update iOS and move funds to newly created wallets on devices where the app was never installed. Security teams noted that deleting the app or installing an OS patch does not change any private key that may already have been copied.

Salus and other investigators are continuing to follow addresses linked to remaining proceeds, and exchanges are monitoring deposits that could allow tracing or restricting movement of the stolen USDT.