🚨【URGENT SECURITY ALERT】@FomoPeek Supply-Chain Malware and iOS Kernel Exploitation ✍️ While many users are now uninstalling FomoPeek, one important point is still being overlooked: This was not a typical Web3 phishing or malicious-signature attack. It involved a supply-chain trojan capable of exploiting the iOS kernel. 💡 If you installed FomoPeek v1.1 or v1.2 on your phone, your other hot wallets on the same device, including MetaMask, OKX Wallet, Trust Wallet and others, may also have been exposed. 🤔 This can be true even if you never imported a private key into FomoPeek itself. 1. Why didn’t the App Store catch it? Traditional app review mainly focuses on the code and behavior visible during the review process. FomoPeek presented itself as a read-only whale-tracking tool and claimed that users did not need to provide any private keys. The malicious exploit code was reportedly embedded into the app as obfuscated modules during the build process. Once launched, the app could identify the device model and iOS version, then select from eight built-in kernel exploit chains to match the target environment. 2. Attack chain: from memory corruption to Keychain access Based on reverse-engineering analysis, the attack flow looked like this: 1️⃣ Memory corruption WebKit / JavaScriptCore vulnerabilities were used to gain arbitrary memory read and write capabilities. 2️⃣ PAC bypass The exploit bypassed Apple’s Pointer Authentication Codes, allowing attackers to modify protected kernel data structures. 3️⃣ Sandbox escape and privilege escalation After gaining elevated privileges, the attacker could break out of the iOS application sandbox and access data outside FomoPeek’s own app container. 4️⃣ Keychain access The malware could access and decrypt data stored in the iOS Keychain, potentially exposing seed phrases, private keys and credentials belonging to other wallets on the same device. 🔦 It could also monitor clipboard data for additional sensitive information. 3. Is uninstalling FomoPeek enough? No. If the exploit had already succeeded, sensitive Keychain data may already have been extracted and sent to a remote command-and-control server. 🔌 Deleting the app stops the software from continuing to run on the device. It does not invalidate private keys that may already have been stolen. ⚒️ If a private key has been exposed, the attacker can still use it to move assets later. 4. Immediate actions recommended by @0xbitslab If you or someone you know installed the affected versions, take the following steps immediately: 🔹 Stop using the old wallet addresses Generate a completely new seed phrase and private key on a clean device that has never installed FomoPeek, or use a hardware wallet. 🔧 Move all assets to the new addresses as soon as possible. 🔹 Reset and update the affected device Update the device to an iOS version that includes the relevant security patches. A full device reset should also be considered before using it again for sensitive wallet operations. 🔹 Separate daily-use devices from asset-storage devices Mobile app sandboxes should not be treated as an absolute security boundary. 🧿 For users holding meaningful amounts of crypto, the device used for daily apps should be separated from the device used to manage funds. For long-term self-custody, hardware wallets remain the safer option. ✊

🛡️Security Breakdown | COLDCARD 【Your private key doesn’t need to be stolen if an attacker can recreate it.】 The deeper issue behind the COLDCARD incident is not phishing or physical compromise — but weak entropy at seed generation. 💡The critical path looked deceptively safe: seed = ngu.random.bytes(32) But underneath, the firmware contained: #define MICROPY_HW_ENABLE_RNG (0) An RNG integration error allowed rng_get() to fall back to MicroPython’s software PRNG instead of the intended hardware RNG. Its state could then be constrained from values such as: 🔰MCU UID + SysTick + RTC Turning seed recovery into an offline search: Constrain RNG ➡️ generate candidate seeds ➡️ derive addresses ➡️ match on-chain address ➡️ recover key The key wasn’t necessarily stolen. ⏰It may have been predictable from birth. That’s why air-gapping alone cannot solve this class of failure: it protects a secret from exfiltration, not from reconstruction. And firmware updates cannot repair seeds generated with weak entropy. Those seeds must be replaced. ☑️Security takeaway: Key security doesn’t begin with storage. It begins with entropy.