DarkSword iPhone Exploit Drains $4M in Cryptocurrency
Sophisticated zero-click attack targets unpatched iPhones to steal private keys and recovery phrases.
1Zero-Click Attack Mechanism
The DarkSword exploit chain targets unpatched iPhones running iOS 18.4 through 18.7. By leveraging malicious websites opened in Safari, attackers bypass standard security protocols. This zero-click method allows unauthorized access to device data without requiring users to download suspicious applications or manually approve any fraudulent wallet transactions during the process.
2Financial Impact Analysis
Bitquery reports that 365 TRON wallets were drained of over $4 million in USDT between October 5 and November 4. While the median loss per victim was $1,029, eight high-value wallets suffered losses exceeding $100,000 each. These eight accounts alone accounted for 63 percent of the total stolen funds.
3Targeting Sensitive Credentials
The toolkit specifically searches for recovery phrases and private keys stored within photos and note-taking applications. By accessing the device's Keychain, the exploit compromises popular wallets including MetaMask, Phantom, Trust Wallet, and Coinbase. The vulnerability resides within the operating system itself, rendering individual wallet security features ineffective against this specific threat.
4Technical Investigation Findings
Google's Threat Intelligence Group, alongside Lookout and iVerify, analyzed the exploit chain on March 18, 2026. Their research confirmed that the attack kit chains six distinct vulnerabilities to hijack device information. Censys identified modules specifically designed to target 18 different cryptocurrency wallet applications, highlighting the systematic nature of this campaign.
5Operational Attack Patterns
Attackers utilized a network of 43 collection addresses linked to a shared fee wallet to consolidate stolen assets. Before draining the balances, the perpetrators sent small amounts of TRX to victims' wallets. This activity suggests a coordinated effort to manage transaction fees while rapidly moving funds away from the compromised accounts.
6Limitations of Traditional Defenses
Unlike typical phishing attacks, DarkSword does not require victims to connect their wallets or sign transactions. Because the exploit extracts the seed phrase directly from the device, changing passwords or revoking token approvals provides no protection. Victims must generate entirely new recovery phrases and migrate their assets to secure, uncompromised wallets.
7Apple Security Response
Apple has issued security updates to patch the vulnerabilities exploited by the DarkSword kit. For users unable to update immediately, experts recommend enabling Apple's Lockdown Mode to restrict device functionality and reduce the attack surface. These measures are essential to prevent further unauthorized access to sensitive data stored on the device.
8Broader Security Implications
The DarkSword incident underscores the risks of storing sensitive recovery phrases on mobile devices. As attackers evolve to bypass traditional wallet approval checks, device-level security becomes the primary defense for digital assets. Users should prioritize hardware-based storage solutions and maintain updated operating systems to mitigate the impact of sophisticated zero-click exploit chains.
Original article: DailyCoin — DarkSword iPhone Exploit Drains $4M in Cryptocurrency