iPhone exploit targets crypto wallet seed phrases

TLDR

A sophisticated iPhone exploit kit called Coruna is actively stealing crypto wallet seed phrases and other financial data from unpatched iOS devices via malicious websites.

1. Coruna uses 23 iOS vulnerabilities to hijack older iPhones and scan for BIP39 recovery phrases, wallet QR codes, and app data.
2. Devices on iOS 13 to 17.2.1 that visit fake exchanges or gambling sites are most at risk, while iOS 17.3 and Lockdown Mode block the known exploit chains.
3. The safest responses are updating iOS, avoiding unknown crypto sites, and keeping seed phrases entirely offline, ideally with hardware wallets.

Deep Dive

1. How The Exploit Steals Seed Phrases

Googles Threat Intelligence Group uncovered a powerful exploit kit, Coruna, that targets iPhones via compromised or fake crypto and gambling sites, with no tap needed beyond loading the page. Reports note five full exploit chains and 23 vulnerabilities affecting iOS 13.0 through 17.2.1, letting attackers bypass WebKit sandboxing and gain system level access. Once on the device, Coruna scans files, photos, notes, and app data for BIP39 recovery phrases, backup phrase keywords, QR codes, and directories of wallets such as MetaMask, Phantom, Trust Wallet, Bitget and similar apps, then exfiltrates them to attacker servers while the user is unaware.

2. Who Is Most At Risk

Coverage from multiple outlets describes the primary risk as iPhones running iOS 13 to 17.2.1 that browse to fake exchanges or gambling portals tailored to crypto users. Coruna fingerprints each visiting device, then only deploys a matching exploit chain if the iOS version is vulnerable, which makes attacks efficient and harder to spot. Apple has patched the main vulnerabilities in iOS 17.3 and later, and security researchers recommend enabling Apples Lockdown Mode, which blocks the exploits WebKit based delivery path on supported devices.

3. Practical Protections For Crypto Users

Security teams and Google researchers consistently recommend several concrete steps.

1. Update to the latest iOS on all Apple devices used for crypto and turn on Lockdown Mode if available.
2. Never store seed phrases, private keys, or recovery QR codes in Notes, photos, email, cloud drives, or password managers that are not explicitly designed for this purpose.
3. Prefer hardware wallets and offline paper backups for seed phrases, and access exchanges and dapps only via bookmarked, verified URLs.

If you believe an iPhone that ever held your seed phrase was on iOS 13 to 17.2.1 and may have visited suspicious crypto sites, the conservative response is to move funds to a new wallet created on a clean, fully updated environment with a brand new seed.

Conclusion

Coruna shows that high end iOS exploit chains once used for espionage are now being rented or repurposed for industrial scale crypto theft. For everyday users, the main defenses are simple but strict: keep devices patched, keep seed phrases entirely offline, and treat any browser session on untrusted crypto sites as a potential attack surface.