Apple's iOS 26.3 update closes every vulnerability exploited by the DarkSword exploit kit, yet the campaign targeting iPhone-based cryptocurrency wallets — with Trust Wallet (TWT) among the affected applications — is still running on handsets that have never installed the patch.

Researchers at the cybersecurity firm Censys report that the operation remains active across nine wallet applications, continuing to threaten iPhone users who have not upgraded their devices. The reach spans nine separate wallet applications rather than a single service, extending the campaign's relevance to iPhone wallet users broadly.

Patch Available, Exposure Remains

The findings underscore a recurring dynamic in mobile security: a vendor patch only protects a device once users actually install it. Apple's iOS 26.3 release addresses the vulnerabilities that DarkSword chains together, meaning fully updated iPhones are no longer susceptible to the kit's techniques. Devices left on older software versions, however, remain within the campaign's reach. Because software adoption happens device by device, exploitation kits can stay viable in the wild even after a fix ships — the exact gap this campaign continues to occupy, and one that persists for as long as handsets go unpatched.

Background on the Targeted Wallet

Trust Wallet is one of the most widely used self-custody cryptocurrency wallets, enabling users to store digital assets and interact with decentralized applications while retaining control of their private keys. Its native utility token, TWT, is used within the Trust Wallet ecosystem. Because mobile wallets hold users' keys directly on the device, they are a recurring target for exploit developers. The self-custody model also raises the stakes of a compromise: no service provider holds a backup of the keys or can reverse a fraudulent transfer, so the security of the handset effectively becomes the security of the funds.

Who Is Censys?

Censys is a cybersecurity company known for measuring and analyzing internet-connected devices and threat infrastructure at scale. Its researchers routinely track attack campaigns and device exposure across large populations, providing the telemetry behind reports of this kind. That scale of measurement is what allows the firm to report whether the operation remains live after a patch's release.

The Practical Takeaway

The core conclusion from the reporting is procedural rather than speculative: users of Trust Wallet and the other affected wallet applications should ensure their iPhones are running the latest iOS release. Installing the iOS 26.3 update eliminates the vulnerabilities the DarkSword kit relies on. Until unpatched handsets are upgraded, the campaign's footprint on those devices remains the development to watch — on fully updated iPhones, the kit's techniques no longer apply.

---

This report was first published by COINOTAG on October 9, 2026: COINOTAG