# DarkSword iPhone Exploit Drains $4M in Cryptocurrency Sophisticated zero-click attack targets unpatched iPhones to steal private keys and recovery phrases. - **Source:** [DailyCoin](https://brifing.si/source/3e9b0f85-cb2f-40ee-ba61-db9410cf0937) - **Published:** 2026-11-06 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/fcc7e1eb-10b0-4a3f-bd0b-44db18f94e91 ## Zero-Click Attack Mechanism The DarkSword exploit chain targets unpatched iPhones running iOS 18.4 through 18.7. By leveraging malicious websites opened in Safari, attackers bypass standard security protocols. This zero-click method allows unauthorized access to device data without requiring users to download suspicious applications or manually approve any fraudulent wallet transactions during the process. ## Financial Impact Analysis Bitquery reports that 365 TRON wallets were drained of over $4 million in USDT between October 5 and November 4. While the median loss per victim was $1,029, eight high-value wallets suffered losses exceeding $100,000 each. These eight accounts alone accounted for 63 percent of the total stolen funds. ## Targeting Sensitive Credentials The toolkit specifically searches for recovery phrases and private keys stored within photos and note-taking applications. By accessing the device's Keychain, the exploit compromises popular wallets including MetaMask, Phantom, Trust Wallet, and Coinbase. The vulnerability resides within the operating system itself, rendering individual wallet security features ineffective against this specific threat. ## Technical Investigation Findings Google's Threat Intelligence Group, alongside Lookout and iVerify, analyzed the exploit chain on March 18, 2026. Their research confirmed that the attack kit chains six distinct vulnerabilities to hijack device information. Censys identified modules specifically designed to target 18 different cryptocurrency wallet applications, highlighting the systematic nature of this campaign. ## Operational Attack Patterns Attackers utilized a network of 43 collection addresses linked to a shared fee wallet to consolidate stolen assets. Before draining the balances, the perpetrators sent small amounts of TRX to victims' wallets. This activity suggests a coordinated effort to manage transaction fees while rapidly moving funds away from the compromised accounts. ## Limitations of Traditional Defenses Unlike typical phishing attacks, DarkSword does not require victims to connect their wallets or sign transactions. Because the exploit extracts the seed phrase directly from the device, changing passwords or revoking token approvals provides no protection. Victims must generate entirely new recovery phrases and migrate their assets to secure, uncompromised wallets. ## Apple Security Response Apple has issued security updates to patch the vulnerabilities exploited by the DarkSword kit. For users unable to update immediately, experts recommend enabling Apple's Lockdown Mode to restrict device functionality and reduce the attack surface. These measures are essential to prevent further unauthorized access to sensitive data stored on the device. ## Broader Security Implications The DarkSword incident underscores the risks of storing sensitive recovery phrases on mobile devices. As attackers evolve to bypass traditional wallet approval checks, device-level security becomes the primary defense for digital assets. Users should prioritize hardware-based storage solutions and maintain updated operating systems to mitigate the impact of sophisticated zero-click exploit chains. ## Sources covering this story - https://dailycoin.com/darksword-iphone-exploit-4m-crypto-theft/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._