Crypto.News DarkSword Exploit Drains Over $5.5 Million from iPhone Crypto Wallets
Article Content
- •DarkSword exploit drains over $5.57 million from iPhone crypto wallets.
- •Attackers exploit zero-click vulnerabilities in Safari on iOS 18.4 to 18.7.
- •Over 20 wallets affected, with significant losses reported across multiple applications.
The DarkSword exploit toolkit has compromised unpatched iPhones running iOS 18.4 to 18.7, draining over $5.57 million from more than 20 cryptocurrency wallets. Attackers leverage a zero-click vulnerability via malicious Safari pages, allowing them to extract sensitive information such as private keys and recovery phrases without user interaction. The exploit chain is built on six vulnerabilities documented by Google, which were reported to Apple but have not been publicly acknowledged or patched as of the latest updates. Security firms CertiK and Bitquery have linked the exploit to significant financial losses across various wallet applications, including MetaMask and Coinbase. The attack appears to have been ongoing since at least August 2026, with researchers still investigating the full scope and identifying the malicious websites used for delivery. Apple has released updates addressing these vulnerabilities, but many devices remain unpatched.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (5)
Following this threat?
Track DarkSword in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which iOS versions are affected?
What are the implications of this exploit?
What should users do to protect themselves?
Continue Reading
APT29 Targets Mobile Users with Watering Hole Campaign APT29, a Russian state-sponsored hacking group, is behind a large-scale watering hole campaign targeting iOS and Android users through compromised websites and fake domains. The campaign, identified by Sekoia in mid-October 2026, employs multiple infection vectors, including JavaScript injection on legitimate sites… 
DarkSword Malware Targets iPhones via Compromised Websites Google's Threat Intelligence Group reported on the DarkSword malware, an exploit kit targeting iPhones running iOS versions 18.4 to 18.7. The malware exploits six vulnerabilities, three of which are zero-days, to take control of devices when users visit compromised websites. The attackers have been linked to three…