What we found

  1. Open the cash menu and look for withdraw.
  2. Click max and continue.
  3. Fill the Solana wallet address field with an address embedded in the code.
  4. Tick the withdrawal warning checkbox, then click review and confirm withdraw.

Evidence

  • Read the bookmarklet attached to the actual installation button and statically resolved its obfuscated strings.
  • The page’s app.js encodes the bookmarklet-src block into the installation link, tying the code to the distributed bookmarklet.
  • The FAQ says the tool only reads the page and cannot touch funds, while the distributed code contains the withdrawal actions above.

Method: read-only source inspection and static analysis. We did not run the bookmarklet or initiate a transaction. The record establishes the actions attempted by the code, not a successful withdrawal or ownership of the destination address.

If you encountered it

Only visited the landing page

The finding concerns running the bookmarklet. It does not establish that visiting the landing page alone transfers funds.

Saved the bookmark but did not run it

Delete the bookmark and do not click it on FOMO.

Ran it on a FOMO page

Close or reload the affected page and delete the bookmark. Check balances, withdrawal history and pending requests immediately. Preserve any abnormal transaction records and contact official FOMO support.

Code fingerprint

SHA-256 of the bookmarklet source at inspection time, for comparison only. No executable script is provided.

d5a69e74b47bc7c5033ef098913bbbce72869928380753a980efa03f3f7ff996

Address embedded in the code

8B3eeYhQyZXSAXJG5KVe4qVV8yx6cJnKLTFt7TD4kZoo