New iPhone exploit targets crypto wallet data

TLDR

A powerful iPhone exploit kit called Coruna is being used to silently steal crypto wallet data from vulnerable iOS devices via booby?trapped websites.

1. Google researchers link Coruna to 23 iOS vulnerabilities on iOS 13-17.2.1, allowing attackers to scan phones for seed phrases, QR codes and wallet data when victims visit compromised sites.
2. Reports say Apple fixed the exploited bugs in iOS 17.3 and later, so the highest risk is for users on older iPhones browsing fake exchange, gambling or other finance themed pages.
3. Crypto users should update iOS, avoid storing seed phrases on their phone, be careful with mobile browsing, and favor hardware or offline key storage for larger balances.

Deep Dive

1. How The Coruna Exploit Works

Googles Threat Intelligence Group describes Coruna as an iPhone exploit kit with five full exploit chains and 23 vulnerabilities that target iOS 13-17.2.1 devices when users load malicious web content in Safari or in-app browsers. Articles summarizing the report explain that Coruna fingerprints the device, chooses an appropriate WebKit exploit, escapes the browser sandbox, then installs malware that can harvest sensitive data, including crypto wallet information and BIP39 seed phrases, from files, photos and notes on the phone.

Coverage from multiple outlets notes that Coruna began as a surveillance tool used in state-linked operations and has since been repurposed by financially motivated groups to steal funds from retail users via fake gambling and crypto sites such as spoofed exchanges and finance portals.

2. Who Is Most At Risk

Security writeups say Coruna focuses on iPhones that have not yet been updated beyond iOS 17.2.1, scanning for terms like backup phrase and bank account and targeting data from wallets such as MetaMask, Trust Wallet, Phantom, Uniswap and others stored on the device. One analysis reports that tens of thousands of devices have already been affected, with losses still being tallied, and stresses that attacks do not require users to sign a malicious transaction, since keys are exfiltrated directly from the phone.

3. Mitigations And Safer Setups

Reports highlight that Apple patched the core bugs exploited by Coruna in iOS 17.3 and later, and that enabling Lockdown Mode can block these exploit chains on supported devices. Security teams also strongly recommend never storing seed phrases, screenshots of recovery words, or private keys in photos, Notes, email or messaging apps on any phone. For significant balances, hardware wallets or other offline key storage sharply reduce the impact of mobile compromises, since attackers cannot steal what is not on the device.

Conclusion

Coruna shows how advanced iPhone exploits have shifted from government surveillance to industrial?scale theft aimed at crypto users. The main defenses are timely iOS updates, removing seed data from phones, and using mobile wallets only for limited, high?convenience use while keeping long?term holdings under keys that never touch a potentially compromised device.