Binance founder Changpeng Zhao has issued an urgent warning to crypto holders: update your iPhones now. A wallet can secure crypto, he noted, but it cannot secure the operating system underneath it. Self-custody, in his words, is a duty — and that duty includes keeping the device itself safe.

The warning came as DarkSword, an iOS exploit chain, returned to haunt security researchers and drain funds from crypto wallets. This is not a problem with any particular wallet, or a bug in a single piece of wallet software; it is a bug in what lies underneath. When an operating system is compromised, the protections offered by wallet software can be circumvented.

What Happened — and Why CZ Urged Everyone to Update

DarkSword was publicly released in March by Google Threat Intelligence Group, Lookout, and iVerify. The researchers detailed six iOS security vulnerabilities capable of evading the Safari sandbox — the security boundary designed to keep web content isolated from the rest of the device — and breaking out to gain higher privileges, as documented in the Google Threat Intelligence report. The attack begins when a victim opens a malicious web page in Safari — no wallet connection or transaction signature is required. That is what separates this from most wallet-draining scams, which hinge on a user approving a malicious transaction; here, simply opening the page was enough.

Once out of the sandbox, the attack would reveal passwords, files and, in some cases, private keys or recovery phrases, as Reuters reported, underscoring the stakes for iOS security. Data linked to the exploit indicated that $5.57 million was lost from more than 20 wallets, and at least 18 malicious websites were identified (Lookonchain).

CZ called on iOS users — above all those not yet on patched versions — to update their systems and restore device security. No wallet application can update the operating system for you, he said, and in self-custody there is no help desk to walk back a transaction or un-lose a seed phrase.

Update your iOS, especially if you haven't updated in a while. No wallet software can update your OS. Self-custody means self responsibility.

— CZ 🔶 BNB (@cz_binance) November 6, 2026

Why iOS Security Matters for Crypto

Crypto security is conventionally discussed in terms of smart contracts, exchanges, bridges and private keys — far less often device security, even though most retail users reach crypto through a mobile device. A mobile wallet is only as secure as its underlying operating system, browser and hardware.

For years, iOS security has been considered hardened, because Apple controls the hardware, the software and the App Store. That reputation can breed complacency: users may forgo updates, or keep an aging device in service for browsing, messaging and banking as well as crypto. DarkSword turns that assumption on its head — one infected web page is enough of an ingress point if the known vulnerabilities are present.

The liability is not confined to one wallet provider. Researchers identified the exploit on devices running iOS versions 18.4 to 18.7, while news reports pointed to potential targets including Trust Wallet, MetaMask, Phantom, Coinbase and Exodus. Switching wallets does not fix an unpatched operating system, because the real failure sits beneath the app layer, in iOS security itself.

Update, Secure, and Protect

Apple has since patched the DarkSword exploits, according to Malwarebytes. Fixes were released via iOS 18.6, 18.7.2 and 18.7.3, along with iOS 26.1 and 26.3, the latter including all six corrected flaws as of 26.3. (The jump from 18 to 26 reflects Apple's 2025 shift to year-based version naming.) Devices that have not installed these fixes remain open to the known chain. The update path is simple: navigate to Settings, then General, then Software Update — and avoid links from unfamiliar accounts.

Users should also reconsider where they store their recovery phrases. Seed phrases do not belong in Notes, Photos screenshots, cloud backups or messaging apps: an attacker with access to the device could read everything stored there in plain text. Those with large holdings can close off part of that attack surface with a hardware wallet or Apple's Lockdown Mode, an optional hardened mode built for users who may be targeted by sophisticated attacks.

If a device is believed to be compromised, users can create a fresh wallet on a clean device, transfer the funds, and discard the old seed phrase. An update protects the device going forward, but it cannot rescue a seed phrase that has already been exposed — generating new addresses from the same seed will not suffice, since the master key is already exposed. In self-custody, updating iOS is not just good device maintenance — it is good crypto hygiene.