iPhone exploit kit targets crypto wallet keys

TLDR

A newly exposed iPhone exploit kit called Coruna is being used to steal crypto wallet keys and recovery phrases from unpatched devices via malicious websites.

1. Google researchers say Coruna chains 23 iOS bugs across versions 13 to 17.2.1 and scans devices for seed phrases, QR codes, and wallet data.
2. The kit appears to have moved from state surveillance use into broad financial theft, targeting wallets like MetaMask, Phantom, Trust Wallet, and others.
3. Updating to iOS 17.3 or higher, using Lockdown Mode, and keeping seed phrases strictly offline are the main defenses, especially for mobile self custody users.

Deep Dive

1. How Coruna Steals Wallet Keys

Googles Threat Intelligence Group identified Coruna as a highly sophisticated iOS exploit kit with five exploit chains and 23 vulnerabilities across iOS 13 through 17.2.1, triggered when users visit booby trapped finance or crypto sites. It fingerprintes the device, uses WebKit remote code execution, then escalates privileges to escape the browser sandbox and gain deep access to the phone.

Once inside, Coruna scans the file system, photos and notes for cryptocurrency related strings, BIP39 seed phrases, QR codes, and app data from self custody wallets such as MetaMask, Phantom, Trust Wallet and others, then exfiltrates them to attacker servers, enabling silent, irreversible wallet draining. Reports from CryptoNews and Coinspeaker highlight this seed phrase theft behavior as the primary goal of the kit, not generic spying.

2. Who Is Most At Risk

Coruna targets iPhones on iOS 13 to 17.2.1; Apple patched the main WebKit bugs in iOS 17.3 and later, but many devices remain on older versions. The attack is generally delivered through fake exchanges, gambling portals, or lookalike crypto pages that mobile traders might visit.

Analyses estimate at least tens of thousands of devices have already been compromised, with Coruna evolving from use by Russian linked espionage actors to financially motivated groups attributed to China. That shift puts ordinary retail crypto users, not just high value targets, directly in scope.

3. Practical Defenses And Next Steps

Security teams and Google recommend three concrete layers of defense:

1. Update iPhones and iPads to the latest iOS, or at least 17.3 or higher, where the relevant Coruna bugs are patched.
2. Enable Apples Lockdown Mode if you hold meaningful crypto on a mobile device; tests indicate it blocks Corunas exploit paths.
3. Treat seed phrases and private keys as strictly offline: store them on paper in secure locations or in hardware wallet environments, not in Notes, screenshots, email, cloud drives, or messaging apps on your phone.

Additional hygiene includes avoiding unfamiliar gambling or high yield crypto sites on mobile, installing wallets only from the official app store, and using hardware wallets for large balances.

Conclusion

Coruna shows that sophisticated iPhone exploit chains are no longer limited to intelligence agencies and are now being repurposed to steal crypto at scale. For everyday users, the main levers are timely iOS updates, cautious browsing around crypto sites, and moving critical keys and recovery phrases off phones and into hardened storage so that even a fully compromised device cannot empty your wallets.