Security firm CertiK has warned that an iPhone exploit tracked as DarkSword can extract cryptocurrency wallet data without requiring users to approve any transaction. In an alert published on X on November 6, CertiK said the exploit is capable of targeting several widely used crypto applications — among them MetaMask, Trust Wallet, Phantom, Exodus and Coinbase — and may additionally harvest passwords and recovery phrases stored elsewhere on an infected device. Recovery phrases are the word sequences that restore full access to a self-custody wallet.

The alert describes a risk that departs from the pattern of conventional wallet-draining attacks, which generally depend on victims signing malicious transactions or granting access to their wallets. DarkSword reportedly goes after weaknesses in the iPhone operating system itself, potentially allowing attackers to reach sensitive information directly from a compromised device. For self-custody users, that distinction matters because the standard safeguard — reviewing and approving each transaction inside a wallet app — offers no checkpoint when data is lifted straight from the operating system.

DarkSword Exploits Six iOS Vulnerabilities

The attack chain was documented by Google's Threat Intelligence Group in a report published on March 18. Researchers described six vulnerabilities affecting iOS versions 18.4 through 18.7 that could be combined to compromise vulnerable devices.

Following successful exploitation, Google identified three malware families being deployed: GHOSTBLADE, GHOSTKNIFE and GHOSTSABER. Their capabilities include collecting cryptocurrency wallet information, device keychain data, Notes databases, browser records and personal media. The keychain is Apple's built-in store for saved passwords and other credentials.

Google also observed campaigns targeting users in Saudi Arabia, Turkey, Malaysia and Ukraine, with activity dating back to at least November 2025.

Apple addressed the vulnerabilities through security updates, with the full set of fixes available by the release of iOS 26.3. Because most patches had been delivered earlier, outdated operating systems stand out as a central factor in the reported exposure.

New DarkSword Variants Expand the Threat

The exploit kit has continued to evolve. Mobile security company iVerify disclosed a P7 variant of DarkSword in an October 8 report, after investigating an infection discovered on a customer's device in August.

According to iVerify, the implant contacts its command server every 15 seconds by default. It also processes keychain information locally before sending data to its operators, and includes a dedicated command to identify installed wallet applications and extract information from imToken.

Distribution has drawn scrutiny as well. A separate investigation published on October 21 by iVerify and Report URI traced the spread of DarkSword through malicious advertising. One campaign reportedly relied on a World Cup-themed Instagram advertisement that infected an employee's device while the person was simply scrolling through the platform.

The researchers also identified a campaign called DeadTag, built on hundreds of re-registered analytics domains. The network associated with those domains was estimated to receive approximately 135 million visits per month. Another distribution method involved a fake Polymarket webpage that delivered two DarkSword variants — vulnerable devices could reportedly become infected automatically as the page loaded.

CertiK recommended using hardware wallets to protect significant cryptocurrency holdings and suggested Apple's Lockdown Mode for people facing elevated security risks. Hardware wallets keep private keys on a dedicated physical device rather than on an internet-connected phone, while Lockdown Mode is an optional Apple setting, introduced in 2022, that restricts a device's functions for users considered to face targeted threats.

CZ Urges iPhone Users to Update After Reported $5.57 Million Loss

Binance co-founder Changpeng Zhao added his voice, urging iPhone users to update their operating systems immediately. In a post on X on Friday, he emphasized that wallet applications cannot fix vulnerabilities in the operating system beneath them, and that users managing their own private keys remain responsible for securing their devices.

His warning followed estimates from security researcher Officer's Notes, who said approximately $5.57 million in digital assets had already been stolen through the vulnerability. The reported losses were linked to more than 18 websites hosting malicious code.

Officer's Notes also reported that the exploit kit was being sold online for approximately $30,000. One version reportedly included a module specifically designed to target the imToken wallet.

According to the researcher, iOS 18.6.2 was the last version supported by the DarkSword exploit — a detail that sharpens focus on devices left unupdated despite Apple's security fixes. References to iOS 26 and iOS 27 found in the kit's code suggest its developers may be preparing to target newer operating system versions, though those references do not by themselves establish that working exploits for those versions are already available.

Researchers Recommend Software Updates and Safer Wallet Practices

DarkSword is not the only reported iOS security concern involving cryptocurrency users. In September, Apple fixed a vulnerability in its CoreGraphics graphics engine that the company acknowledged may have been exploited in sophisticated attacks against specific individuals. Separately, security researchers from SlowMist and OKX previously identified malicious code in the FomoPeek application that could access information beyond the app's normal permissions on iOS. Taken together, the incidents direct attention to the device layer beneath wallet applications — the same layer CZ singled out in his warning.

Security recommendations from the researchers include installing the latest available iOS updates through Settings, General and Software Update, and avoiding storage of wallet recovery phrases in Notes, Photos or screenshots, where malware operating on a compromised device may be able to reach them. Links shared through Telegram groups and direct messages should be treated cautiously, particularly when they lead to unfamiliar websites — the reported fake Polymarket page demonstrates how simply loading a malicious webpage could expose an unpatched device.

For users who believe their phones have already been compromised, the guidance described in the source material is to create a new wallet on an updated device and transfer any remaining funds. The old recovery phrase should not be reused.

The DarkSword reports underline the security risks of keeping wallet credentials on internet-connected smartphones. Updating the operating system, protecting recovery phrases and using hardware-based storage for significant holdings can reduce exposure to attacks targeting the device itself rather than a wallet application's transaction process. The developments to watch from here are further advisories from CertiK, iVerify and Google, and whether the kit's references to newer iOS versions are ever confirmed as working exploits.

Source: en.coinotag