New iPhone exploit targets crypto wallet secrets

TLDR

Security researchers have revealed a powerful iPhone exploit kit that can steal crypto wallet recovery phrases from some iOS versions, putting users with mobile self-custody at higher risk.

1. Google has disclosed an iOS exploit kit called Coruna that can silently infect iPhones via malicious websites and scan for crypto wallet data, including seed phrases.
2. Devices running iOS 13 to 17.2.1 are affected; newer iOS versions are reportedly patched, so updating sharply reduces risk but does not fix bad storage habits.
3. The most effective protections are keeping iOS fully updated, never storing seed phrases on the phone, and using hardware wallets or offline backups for significant funds.

Deep Dive

1. What The Exploit Actually Does

Googles Threat Intelligence Group and Mandiant describe a sophisticated iOS exploit kit dubbed Coruna with five full exploit chains and 23 vulnerabilities targeting iOS 13 to 17.2.1 devices. Reports note that it can infect an iPhone when a user simply visits a compromised or fake crypto or gambling site, using WebKit browser bugs to run code without any taps or downloads first.

Once installed, the malware can fingerprint the device and deploy payloads that scan images, files and apps for keywords like backup phrase and bank account, allowing attackers to lift recovery phrases and other financial data from the phone. Coverage from multiple outlets, including a detailed breakdown of Corunas capabilities, connects it directly to theft of crypto wallets.

2. Who Is Most At Risk

Coruna has reportedly been used first in state-level espionage campaigns and then by financially motivated groups on hundreds of crypto themed sites, especially in Chinese and Ukrainian targeting. That makes three groups stand out as higher risk:

1. Users who keep self-custody wallet seed phrases in photos, screenshots, Notes, email, or cloud backups on their iPhone.
2. Mobile-only DeFi and trading users who routinely click unknown links to airdrops, gambling apps, or high yield platforms in Safari or in-app browsers.
3. High value holders who use the same phone for both wallet access and sensitive messaging.

Exchange apps are less directly exposed than raw seed storage, but a full device compromise can still read SMS or app based 2FA, so it should not be treated as a complete safety net.

3. Practical Protections And What To Watch

Security teams say the underlying Coruna vulnerabilities have been patched in the latest iOS versions, and recommend updating iPhones immediately, as the kit does not work against fully up to date devices. Enabling automatic updates and avoiding jailbroken or heavily modified devices further reduces exposure.

For crypto specifically, the higher impact changes are behavioral: never store seed phrases or private keys on a phone in plain text or images, keep large balances on hardware wallets or other offline storage, and treat links to trading or gambling sites as untrusted unless carefully verified. For very high risk profiles, Apples Lockdown Mode and a dedicated crypto phone with minimal apps can reduce the attack surface.

Signals to watch next include new Apple security advisories, further reports from Google or Mandiant on Coruna variants, and any wallet providers warning about mobile compromises targeting their users.

Conclusion

A sophisticated browser based exploit like Coruna turns an older or unpatched iPhone into a potential backdoor straight to your wallet secrets, especially if your seed phrase lives on the device. Keeping iOS fully updated is necessary but not sufficient; the real safety gain comes from treating phones as hot, high risk environments and moving long term crypto secrets and large balances to hardware or other offline storage.