That FomoPeek about “downloading the app on your phone and filling in an invitation code to get 5U” a few days ago has issued a security warning. (The Twitter post is gone now.)
The part that really sent chills down my spine after reading it is this: even if you didn’t import your private key into that app, you could still be at risk.
According to the alerts from OKX and SlowMist, the affected version had malicious code injected. After the attack succeeds, it can break through iOS isolation mechanisms and access data from other apps. Your phone’s private keys, seed phrases, and login credentials could all be impacted.
When you look back at those promotional posts: no real-name verification required—just fill in an invitation code and do whatever for a few minutes to get paid. Some offer 5U, others 7U. The lower the barrier, the easier it is for people to drop their guard.
I found promotion records from a few bloggers, and I’ve put the evidence in the comments. Whether they knew in advance is still unclear—there’s no evidence yet. But teachers who promoted it: please spread the warning to the people who downloaded it at the time as soon as possible, especially those users you collected emails from or rewarded.
If you installed the affected version, stop using it first. Follow the warning: generate a brand-new wallet on a confirmed-clean device and transfer your assets. Don’t just delete the app and assume everything is safe.
Wanting to earn a few bucks is not wrong. The people who put malicious code into the app are the ones who should be investigated and held accountable.
The part that really sent chills down my spine after reading it is this: even if you didn’t import your private key into that app, you could still be at risk.
According to the alerts from OKX and SlowMist, the affected version had malicious code injected. After the attack succeeds, it can break through iOS isolation mechanisms and access data from other apps. Your phone’s private keys, seed phrases, and login credentials could all be impacted.
When you look back at those promotional posts: no real-name verification required—just fill in an invitation code and do whatever for a few minutes to get paid. Some offer 5U, others 7U. The lower the barrier, the easier it is for people to drop their guard.
I found promotion records from a few bloggers, and I’ve put the evidence in the comments. Whether they knew in advance is still unclear—there’s no evidence yet. But teachers who promoted it: please spread the warning to the people who downloaded it at the time as soon as possible, especially those users you collected emails from or rewarded.
If you installed the affected version, stop using it first. Follow the warning: generate a brand-new wallet on a confirmed-clean device and transfer your assets. Don’t just delete the app and assume everything is safe.
Wanting to earn a few bucks is not wrong. The people who put malicious code into the app are the ones who should be investigated and held accountable.