iPhone cryptocurrency holders need to update their iOS version immediately. Attacks have been discovered that can steal wallet data even without installing malicious apps.

This concerns DarkSword, a dangerous iPhone hacking tool that researchers at Google Threat Intelligence, Lookout, and iVerify first exposed in March 2026.

BUT the threat hasn’t gone away. On October 8, iVerify researchers reported discovering a new version of DarkSword that can steal saved passwords and crypto wallet data.

How does the attack work?

The attackers use a chain of six iOS vulnerabilities. To infect a vulnerable device, all it takes is opening a malicious page in Safari❗️️️️️️️ It could even be a legitimate website that has been hacked.

There’s no need to download, install, or confirm anything.

Once inside, the malicious code gains expanded access to the system and can collect:

- Crypto wallet data, including MetaMask, Phantom, Exodus, and others.

- Saved passwords and data from the system keychain.

- Notes, photos, and files that may contain seed phrases (a shout-out to those who like to store them this way).

- WHAT’S MORE, Telegram and WhatsApp chats and other personal information. A shout-out to those who store seed phrases in Telegram’s “Saved Messages.”

The stolen data is sent to the attackers. Some versions of DarkSword can finish collecting information in just minutes, then erase some traces of their activity.

❗️️️️️️️ Especially important: Face ID, a wallet password, and standard security settings do NOT guarantee protection if attackers have managed to hack the operating system itself.

Which iPhones are at risk?

Researchers confirmed that DarkSword works against outdated versions of iOS 18.4–18.7. Apple released patches in stages, including iOS 18.7.7 and iOS 26.3.

The company officially confirmed the existence of similar web-based attacks and urged users to update their devices.

What should you do?

1. Open Settings > General > Software Update and install the latest available version of iOS.

2. Turn on automatic updates for your system and apps.

3. Don’t store seed phrases in Notes, photos, the cloud, or chats.

4. If you have reason to suspect an infection, change your passwords using another, secure device. Transfer crypto assets from potentially compromised wallets to new addresses with a new seed phrase as soon as possible.

❗️️️️️️️ IMPORTANT: Updating iOS patches known vulnerabilities, but it does NOT undo any theft of keys that may have occurred before the update.

Reports of funds disappearing from iPhones are already circulating in the crypto community. Some of our subscribers have been affected, too.