A member just messaged the team after losing $27K from their Trust Wallet
According to their account, they were using iOS 16 and had only written down their key on paper, without storing it online. They tapped a Trust Wallet update pop-up, and just a few minutes later, discovered that the assets in their wallet had been transferred out.
The exact reason they lost their funds has not yet been determined, but I recently came across a warning from SlowMist about the DarkSword & Coruna vulnerabilities—malware that specifically exploits iPhone vulnerabilities.
On older versions of iOS, hackers can gain access to a device when the victim opens a malicious website in Safari, without needing them to enter their seed phrase or sign a transaction. Coincidentally, the member who experienced this issue was using Trust Wallet on iOS 16.
This malware can also collect wallet data, attempt to decrypt wallet key data, check balances, and sweep assets.
There are some similarities to the member’s case, although there isn’t enough evidence to link it to DarkSword.
In short, I’m sharing this case to remind everyone to keep iOS up to date to patch security vulnerabilities, and to be cautious of suspicious websites and pop-ups.
IF YOU SUSPECT YOUR DEVICE HAS BEEN COMPROMISED, don’t keep using your old wallet to store your assets. Use a clean device to create a new wallet with a completely new seed phrase, then transfer your assets to it.
According to their account, they were using iOS 16 and had only written down their key on paper, without storing it online. They tapped a Trust Wallet update pop-up, and just a few minutes later, discovered that the assets in their wallet had been transferred out.
The exact reason they lost their funds has not yet been determined, but I recently came across a warning from SlowMist about the DarkSword & Coruna vulnerabilities—malware that specifically exploits iPhone vulnerabilities.
On older versions of iOS, hackers can gain access to a device when the victim opens a malicious website in Safari, without needing them to enter their seed phrase or sign a transaction. Coincidentally, the member who experienced this issue was using Trust Wallet on iOS 16.
This malware can also collect wallet data, attempt to decrypt wallet key data, check balances, and sweep assets.
There are some similarities to the member’s case, although there isn’t enough evidence to link it to DarkSword.
In short, I’m sharing this case to remind everyone to keep iOS up to date to patch security vulnerabilities, and to be cautious of suspicious websites and pop-ups.
IF YOU SUSPECT YOUR DEVICE HAS BEEN COMPROMISED, don’t keep using your old wallet to store your assets. Use a clean device to create a new wallet with a completely new seed phrase, then transfer your assets to it.