Ledger CTO warns of iPhone crypto exploit

TLDR

Ledgers Chief Technology Officer is warning iPhone crypto users about DarkSword, a Safari-based exploit that can steal wallet keys from compromised devices.

1. DarkSword is a multi-step iOS exploit that can take over an iPhone after you visit a malicious website and then access wallet data and seed phrases.
2. The biggest risk is to users who store recovery phrases or private keys on their phones, with related iOS malware showing mobile crypto wallets are a prime target.
3. Keeping iOS fully updated, removing seed phrases from phones, and using hardware wallets are the main ways to reduce exposure to DarkSword and similar attacks.

Deep Dive

1. What DarkSword Does

Ledger CTO Charles Guillemet highlighted DarkSword as an iPhone exploit chain that starts when a user opens a malicious page in Safari and then chains several iOS vulnerabilities to gain deep device access. In his words, you visit a website and lose your crypto, because the exploit can reach wallet data once the phone is compromised.

Security writeups explain that DarkSword first abuses Safaris JavaScriptCore engine, then bypasses Pointer Authentication Codes, escapes the browser sandbox, and finally hits the iOS kernel to pull keychain entries, messages, files, and wallet information from the device, including recovery phrases stored in screenshots or notes. This behavior has been documented in detail in the original DarkSword iOS exploit disclosure.

Googles Threat Intelligence Group reported DarkSword in March 2026 and tied it to real-world campaigns in Saudi Arabia, Turkey, Malaysia, and Ukraine, showing this is an active tool rather than a lab proof-of-concept.

2. Why Crypto Users Are Exposed

For crypto holders, the key issue is where your secrets live. A private key controls a wallet, and a seed phrase is the backup that can recreate it. If DarkSword or similar malware reaches those secrets on your phone, an attacker can drain your funds without ever touching an exchange account.

Researchers at SlowMist warn that variants of DarkSword may now target newer iOS versions like 26.5, giving attackers root-level control via a single malicious Safari link, though that expansion to 26.5 is not yet independently confirmed. Their warning about iPhone exploit campaigns is reinforced by separate cases such as the FomoPeek iOS malware, which used an exploitation framework with eight methods to steal keys and seed phrases from iOS devices via an App Store app, as detailed in the FomoPeek malware investigation.

Even when Apple patches specific vulnerabilities, the pattern is clear: mobile devices that store wallet credentials are a high-value target for sophisticated attackers.

3. Practical Safety Steps

Ledgers CTO and multiple security teams converge on three main mitigations. First, update iOS to the latest version, since Google and Apple confirm that DarkSwords initially disclosed vulnerabilities were fixed in iOS 26.3 and later security releases. Delaying updates leaves you in the highest-risk bucket.

Second, stop storing seed phrases, private keys, or wallet backups on your phone in plain text, screenshots, notes, or cloud-synced files. Anything DarkSword can read, a human attacker can use to take over your wallets.

Third, favor hardware wallets for significant holdings and treat your iPhone as a signing or viewing tool, not as the place where recovery phrases live. Be cautious with Safari links from unknown sources and install wallet-related apps only from publishers you can independently verify.

Conclusion

Ledgers warning is less about iPhones in general and more about the danger of mixing powerful mobile exploits with poorly protected wallet secrets. DarkSword shows that a single malicious web page can bridge that gap. The practical edge for crypto users is simple: keep iOS patched, move recovery data off phones, and rely on hardware-backed self-custody where possible so that browser and app exploits cannot directly reach your keys.