TLDR
A powerful new iPhone exploit kit called Coruna is actively being used to steal crypto wallet seed phrases from unpatched devices.
- Coruna chains 23 iOS bugs on versions 13 to 17.2.1 to scan for wallet recovery phrases, QR codes and app data, enabling full theft of funds.
- It has shifted from state-grade spyware to mass retail theft, delivered through fake gambling and crypto sites, with at least tens of thousands of iPhones reportedly exposed.
- Updating to iOS 17.3 or later, using Lockdown Mode, and keeping seed phrases off phones greatly reduces exposure to this specific threat.
Deep Dive
1. How Coruna Steals Wallet Keys
Googles Threat Intelligence Group identified Coruna as an iOS exploit kit that bundles five exploit chains and 23 vulnerabilities targeting iOS 13.0 through 17.2.1 on iPhones released since 2019. It is delivered via booby-trapped websites, often fake exchanges or gambling platforms, that fingerprint your device then fire the matching exploit chain to escape the browser sandbox and gain system level access.
Once inside, Coruna searches for crypto related data, including BIP39 seed phrases (the 12 to 24 word recovery phrases used to restore wallets), QR codes and wallet app directories such as MetaMask, Trust Wallet and Phantom, plus Notes or photos containing backup phrase or banking keywords. Reports describe it exfiltrating this data to attacker servers, allowing wallets to be drained without any on chain approval prompt from the user.
the exploit does not break blockchain cryptography, it simply steals your keys wherever you have carelessly stored them on the phone.
2. Who Is Most At Risk
Victims are primarily iPhone users running iOS 13 to 17.2.1 who visit compromised or fake crypto sites from the device they use for mobile wallets. Analysts highlight campaigns using Chinese language finance and gambling pages and fake exchange brands to lure crypto traders.
Apple has patched the key WebKit vulnerability (including CVE-2024-23222) in iOS 17.3 and above, and Lockdown Mode is reported to block Corunas web exploit path. Community reporting citing Apple and Google research estimates at least about 42,000 devices have been affected so far, which is large enough to matter but still a small slice of total iPhones.
3. Practical Protections And Emerging Trends
For crypto users, several patterns stand out: phones are increasingly targeted because they mix browsing, messaging and hot wallets in one place, and high end exploits that once served espionage are now repurposed for profit focused wallet draining. Coruna fits a broader growth in wallet drainer kits and phishing campaigns tuned specifically to crypto user behavior.
Risk is materially lower if you keep significant funds in hardware or other offline wallets, use your phone only as a spending or trading hot wallet, avoid storing seed phrases in Notes or screenshots, and keep iOS fully up to date with Lockdown Mode enabled when possible.
treat any site offering gambling, high yield or unofficial exchange access in your mobile browser as high risk, and assume that whatever crypto secrets live on that phone can eventually be exposed.
Conclusion
Coruna shows that iPhones are no longer a safe by default place for crypto keys when they run outdated iOS and are used to browse risky sites. The exploit kit works by stealing recovery data, not by breaking blockchains, so tightening how and where you store seed phrases and limiting what your phone can see are now central to protecting your assets.
CoinsKid.Com