iPhone exploit exposes crypto wallets to theft

TLDR

An active iPhone exploit called DarkSword, paired with Coruna malware, can steal data from crypto wallets and recovery phrases on unpatched devices.

1. DarkSword uses Safari/WebKit bugs to install Coruna, which targets major mobile wallets and scans your phone for BIP39 seed phrases.
2. Stolen app data and recovery phrases can let attackers fully take over Coinbase, MetaMask, Trust Wallet, Phantom and other wallets, draining funds across chains.
3. Updating iOS to the latest release, avoiding seed backups in photos/notes, and tightening wallet hygiene materially reduce the risk from this exploit class.

Deep Dive

1. How The DarkSword Exploit Works

Security researchers report that the DarkSword iPhone exploit is still in use to deploy Coruna malware against crypto users on iOS devices. It abuses vulnerabilities in Apples WebKit and JavaScriptCore, typically via a malicious website or content loaded in Safari or in-app browsers, to gain access to device data.

Once installed, Coruna focuses on crypto: it specifically looks for apps such as Coinbase, MetaMask, Trust Wallet, Phantom, Exodus, Uniswap, Bitpie, imToken and OKX, and it can search photos and notes for BIP39 recovery phrases, according to a DarkSword exploit report.

Apple has reportedly patched the known DarkSword-related bugs in iOS 26.3, but any iPhone still running earlier versions remains at higher risk if the security updates are missing.

2. Why Crypto Wallets Are Exposed

If Coruna or similar malware gains system-level access, it can:

1. Read data from targeted wallet apps, including cached keys or session tokens where protections are weak.
2. Harvest BIP39 seed phrases from screenshots, photos of paper backups, or notes documents.
3. Combine that information to reconstruct wallets on an attacker-controlled device and transfer assets.

Because a valid seed phrase or key is chain-agnostic, one successful compromise can expose Bitcoin, Ethereum, Solana and multiple tokens at once, including funds held in DeFi and CEX-linked hot wallets.

3. Practical Ways To Reduce Risk

You can materially cut this specific risk by tightening both device security and wallet hygiene:

1. Keep your iPhone on the latest iOS, which includes WebKit and JavaScriptCore patches that close DarkSwords known entry points.
2. Treat seed phrases as strictly offline secrets: do not store them in photos, notes, email or cloud drives on any phone.
3. Prefer verified wallet apps from the official App Store publisher; avoid sideloaded or cloned apps and be cautious with in-app browsers opening unknown links.
4. Consider using a hardware wallet for larger balances, with your phone acting only as an interface, not as the primary key-storage device.

If you suspect your device was exposed to a malicious site and you store seeds or wallet data on it, a cautious step is to migrate funds to a fresh wallet created on a clean, trusted setup.

Conclusion

An active iPhone exploit chain like DarkSword matters because it bridges browser bugs into full wallet compromise by stealing app data and recovery phrases. The main defenses are timely iOS updates, truly offline seed storage, and limiting how much critical key material ever touches a general-purpose phone.