TLDR
Google security researchers have revealed a powerful iPhone exploit kit, Coruna, that can steal crypto wallet data from vulnerable devices.
- Coruna chains 23 iOS vulnerabilities to silently compromise iPhones and scrape seed phrases, QR codes, and wallet data when users visit booby-trapped sites.
- It targets iOS 13 through 17.2.1 and has moved from state surveillance into financially motivated campaigns that focus on crypto users on older or unpatched devices.
- The main defenses are updated iOS, not storing recovery phrases on the phone, and moving significant balances to more isolated wallet setups.
Deep Dive
1. How The Coruna Kit Works
Googles Threat Intelligence Group and partners describe Coruna as an iOS exploit framework with five full exploit chains and 23 separate vulnerabilities targeting iOS 13 to 17.2.1. It infects a device when a user simply visits a compromised or fake crypto or gambling website, using WebKit and privilege escalation bugs to escape the browser sandbox and run code on the phone.
Once installed, Coruna can scan files, messages, photos and app data for wallet-related content such as backup phrase, BIP39 seed words, bank details, QR codes, and data from apps like MetaMask and other wallets, enabling attackers to drain funds without any malicious transaction approval from the victim. One analysis notes it specifically hunts mnemonic phrases and QR codes and can steal keys directly from unpatched devices.
This is not a phishing popup. It is closer to spyware that exfiltrates your keys in the background if the device is vulnerable and you visit the wrong site.
2. Who Is Most At Risk
Reports highlight that Coruna was first seen in 2025 in surveillance-style operations, then in campaigns attributed to a Russian espionage group, and more recently on Chinese-language crypto scam sites targeting iPhone users. Google and media coverage stress that it is now used by financially motivated criminals, not only state actors, to steal cryptocurrency at scale.
The kit affects iPhones running iOS 13 through 17.2.1, but the vulnerabilities it uses have been patched in newer iOS releases. Analysts note that attacks are delivered through compromised or fake crypto and gambling sites, so users who frequently browse such sites with older iOS versions and who store wallet data on-device are the primary targets. Decrypts coverage and crypto.news both underline that updating to the latest iOS significantly reduces exposure.
The biggest risk is for iPhone users who both use self-custody wallets on their phone and have delayed iOS updates or keep sensitive data in photos or notes.
3. Practical Security Priorities
Based on the technical details, three defensive priorities stand out:
- Keep iOS current, since the known Coruna chains do not work against the latest versions.
- Avoid storing seed phrases or private keys in notes, screenshots, chat logs, or cloud-synced photos that malware can scan.
- Treat your phone wallet as a hot wallet and keep larger holdings in more isolated setups, such as hardware wallets or mobile cold-storage style solutions, so a single device compromise does not expose your entire portfolio.
For everyday crypto use, assume your phone can be compromised and design your setup so that a device-level breach risks only a small, replaceable portion of your assets.
Conclusion
Googles discovery of the Coruna exploit kit shows that iPhone security is not absolute, especially for crypto holders using older iOS versions and storing recovery data on-device. The main shift is that state-grade iOS exploit chains are now in the hands of profit-driven scammers who specifically target wallet keys, not just messages or location data. Keeping iOS updated, treating phones as hot wallets only, and never storing seed phrases in readable form on the device together go a long way toward reducing the impact of this class of attack.
CoinsKid.Com