CoinMeta data: SlowMist, in conjunction with the security teams of OKX and OKX Wallet, has confirmed that the official App Store versions 1.1 (September 9) and 1.2 (September 12) contained malicious modules. These modules enabled functions such as remote control, exploitation of the iOS kernel, privilege escalation, sandbox escape, Keychain decryption, and cross-application data collection. These modules were removed in version 1.3 (September 17). Dynamic verification shows that the attack chain was capable of collecting device information, a list of installed applications, wallet applications, and Keychain data. During tests, it was successful in uploading Apple Notes database files. Tracking of funds revealed that they were transferred across networks such as Tron, Ethereum, and BNB Chain. The main hacker addresses have received approximately 579,984 USDT. SlowMist recommends that users who had installed versions 1.1 or 1.2 stop using them and not reinstall them. Instead, they should create new wallets on clean devices that have not previously installed this application, migrate their assets, and update their relevant credentials, as well as check their transaction and authorization records.