DarkSword iOS exploit drains over $4 million in crypto via Safari clicks
Security researchers have tracked an iOS exploit kit dubbed DarkSword that compromises iPhones running iOS 18.4 through 18.7 when users open malicious Safari links, leading to millions of dollars in stolen cryptocurrency.
Security researchers at Google, Lookout, and iVerify have tracked an iOS exploit kit known as DarkSword operating in the wild. The zero-click style compromise affects unpatched devices running iOS 18.4 through 18.7, triggering immediately when a victim opens a malicious webpage in Safari. The attack executes without prompting the user for any wallet connection, signature, or approval, allowing attackers to siphon Keychain credentials, Notes and Photos containing seed-phrase screenshots, and wallet files alongside private keys.[1][2][3]
On-chain tracking by blockchain analytics firm Bitquery revealed that between October 5 and November 4 (UTC), the campaign drained at least $4.06 million in USDT from 365 TRON wallets. The stolen funds moved through a coordinated network of 43 collector addresses tied back to a single fee wallet. In addition to the TRON losses, Bitquery identified more than $103,000 taken from 65 wallets across eight other blockchain networks, matching one of the theft transactions to a documented iPhone victim down to the exact second.[1][2][3]
Cybersecurity firm SlowMist has mapped over 1,500 phishing domains associated with the operation. Analysts emphasize that the compromise is an operating system and device-level issue on the phone itself rather than a vulnerability within Trust Wallet or other wallet software. Recommended precautions include upgrading immediately to iOS 18.7.7 or iOS 26.3 or higher, removing recovery phrases and screenshots from Photos and Notes, and moving assets to a fresh wallet on an uncompromised device if an unknown address deposits TRX or ETH to cover transaction fees.[1][3]
Key facts
- Google, Lookout, and iVerify tracked an iOS exploit kit dubbed DarkSword targeting iOS versions 18.4 through 18.7.
- The exploit kit activates when opening a malicious link in Safari without requiring a wallet connection, signature, or approval.
- DarkSword extracts device data including Keychain credentials, Notes, Photos containing seed-phrase screenshots, and crypto wallet private keys.
- Bitquery traced at least $4.06 million in USDT stolen from 365 TRON wallets between October 5 and November 4 (UTC).
- The attackers utilized 43 collector wallets tied to one fee wallet and drained over $103,000 from 65 wallets across eight other blockchains.
- SlowMist mapped more than 1,500 phishing domains connected to the DarkSword campaign.
- The thefts stem from a device-level iOS compromise rather than a software bug within Trust Wallet.
Sources · 3 sources
- CB
Crypto Banter@crypto_banterPost on X ·
🚨IPHONES DRAINED FOR $4M+ JUST BY OPENING A LINK IN SAFARI! DarkSword, an iOS exploit kit, is hitting unpatched iPhones on versions 18.4–18.7. Visit a malicious page in Safari and it can pull Keychain passwords, Notes, Photos, and crypto wallet data without any approval or wallet connection. @Bitquery_io traced at least $4.06M USDT out of 365 TRON wallets through a network of 43 collector addresses tied to one fee wallet. @SlowMist_Team has already flagged over 1,500 related phishing domains. This is a device-level attack, not a wallet bug. Update iOS and keep seed phrases off your phone.
Open source - CN
crypto.news@cryptodotnewsPost on X ·
BREAKING: DarkSword iOS exploit targets crypto wallets through Safari The attack reportedly steals private keys from iPhones after a malicious link is opened, with around $4.06 million drained from wallets across TRON and other networks. https://t.co/0Axgmg25u3
Open source - SI
Solid Intel 📡@solidintel_xPost on X ·
INTEL: $4.06M DRAINED FROM IPHONES WITH ONE SAFARI CLICK DarkSword is an iOS exploit kit Google, Lookout and iVerify tracked in the wild. On iOS 18.4–18.7, opening a malicious site in Safari is enough. No wallet connect. No signature. No approval. What it steals from the phone: > Keychain credentials > Notes and Photos (seed screenshots) > Crypto wallet files and private keys Bitquery then followed the money on-chain (5 Oct – 4 Nov UTC): > At least $4.06M USDT from 365 TRON wallets > 43 collector wallets tied to one fee wallet >+$103K from 65 wallets on 8 other chains > One theft matches a published iPhone victim to the second SlowMist also mapped 1,500+ related phishing domains. This is not a Trust Wallet bug - it's the phone. Do this now: 1. Update iOS (18.7.7+ or iOS 26.3+) 2. Never store seeds in Photos, screenshots or Notes 3. If an unknown wallet just sent you a few TRX/ETH for "fees," move funds to a fresh wallet on a clean device
Open source