Critical iPhone exploit threatens crypto wallet security

TLDR

A newly exposed iPhone exploit kit called Coruna can silently steal crypto wallet data from vulnerable iOS devices.

1. Coruna chains 23 iOS vulnerabilities on iOS 1317.2.1 to hijack iPhones via malicious websites and harvest wallet secrets.
2. The main risk is to users who store seed phrases or use hot wallets on unpatched iPhones, especially when visiting fake crypto or gambling sites.
3. Updating to iOS 17.3 or later, keeping seed phrases fully offline, and reducing hot wallet exposure on phones sharply lowers this specific risk.

Deep Dive

1. What The Coruna Exploit Actually Does

Googles Threat Intelligence Group identified a powerful iOS exploit kit dubbed Coruna that targets iPhones running iOS 13 through 17.2.1, chaining 23 vulnerabilities across five exploit chains to bypass Apples protections. It is deployed through compromised or fake gambling and crypto-related websites that fingerprint the device, then deliver the most suitable exploit for that model and OS version. Once in, Coruna loads additional payloads that scan local files, photos, and apps for crypto-related data, including recovery phrases and financial information, allowing attackers to drain wallets without further interaction. One detailed summary notes that it started in surveillance operations and has shifted into financially motivated campaigns.

2. How It Targets Crypto Wallets Specifically

Multiple reports say Coruna looks for BIP39 seed phrases, QR codes, and wallet app data from tools like MetaMask, Trust Wallet, Phantom and others stored on the device or in apps like Notes and messaging. It searches for keywords such as backup phrase and bank account, and can exfiltrate data from wallet directories, turning any seed or private key stored on the phone into low-hanging fruit for theft. Because it steals keys directly, there is no suspicious transaction prompt to reject; funds can disappear even if you never sign a malicious transaction.

3. Practical Defenses And What To Watch

Apple has already patched the exploited bugs in iOS 17.3 and later, and researchers emphasize that devices on the latest iOS are not affected by the known Coruna chains. Security teams also highlight generic but critical hygiene: keep seed phrases completely offline, favor hardware wallets for meaningful balances, and avoid interacting with unfamiliar gambling or too good to be true crypto sites or fake exchange pages that are being used as lures. Going forward, the key things to watch are further disclosures from Apple and Google, any confirmation of new Coruna variants targeting newer iOS versions, and signs that similar kits are being weaponized against Android.

Conclusion

Coruna shows that iPhones are no longer a safe by default place for crypto keys when left unpatched or used carelessly. The exploit moves state-grade techniques into retail theft, turning poor seed storage habits and risky browsing into direct wallet drain risk. Keeping iOS updated, shifting critical keys to offline or hardware storage, and tightening browsing hygiene can materially reduce exposure to this and future mobile exploit kits.