DarkSword iPhone Exploit Drains $4M in Crypto Theft 

A silent zero-click exploit chain targeting iPhones has drained more than $4 million in cryptocurrency across 365 TRON wallets, according to a report by Bitquery. 

Dubbed DarkSword, the sophisticated attack kit compromises unpatched iOS devices through Safari—allowing hackers to extract private keys and seed phrases without requiring a single transaction signature or app download.

DarkSword, a kit for hacking iPhones, chains six iOS vulnerabilities to hijack devices running iOS 18.4 through 18.7. It compromises vulnerable iPhones through malicious websites opened in Apple's Safari browser. 

The exploit chain combines multiple security vulnerabilities to gain access to sensitive device information without requiring users to download an application or authorize a wallet transaction.

Google's Threat Intelligence Group (GTIG), together with cybersecurity firms Lookout and iVerify, published technical analyses of the exploit on March 18, 2026. Their findings describe an attack chain capable of accessing passwords, messages, and cryptocurrency wallet information stored in Apple's Keychain.

A separate investigation by cybersecurity firm Censys identified modules targeting 18 cryptocurrency wallet applications. The toolkit can reportedly search photos and note-taking applications for recovery phrases, potentially exposing wallets whose credentials were stored on the device.

Targeted applications reportedly include MetaMask, Phantom, Trust Wallet, and Coinbase. The vulnerability lies in the iPhone's operating system rather than the individual wallet applications.

Unlike conventional phishing attacks, DarkSword does not necessarily require victims to connect their wallets or approve suspicious transactions. Attackers who obtain a private key or recovery phrase can use another device to sign and broadcast transactions.

Bitquery's investigation identified a network of 43 collection addresses connected through a shared fee wallet. The addresses received funds from 365 TRON wallets between October 5 and November 4.

The investigation found that at least $4.06 million in USDT was transferred. Of the 365 wallets affected, the median loss was $1,029. Eight wallets lost more than $100,000 each, accounting for 63% of the total USDT losses. The attackers reportedly sent small amounts of TRX to victims’ wallets shortly before draining their balances.

Bitquery traced the transfers back to an initial transaction whose amount and timing matched those of a publicly reported iPhone theft. However, blockchain records cannot reveal which devices or wallet applications individual victims were using.

Apple has released security updates addressing the vulnerabilities used by DarkSword. Google recommends installing the latest available iOS version or enabling Apple's Lockdown Mode when an update is not possible.

Cryptocurrency holders should also: 

Changing wallet passwords or revoking token approvals is not sufficient if attackers already possess the recovery phrase. A compromised seed requires generating a new one and transferring the assets.

DarkSword device-level attacks bypass wallet approval checks, so exposed seed phrases can lead to total loss without a single signature from the victim.

Explore DailyCoin’s popular crypto news today:
Bitcoin Tumbles to $75K as AI Fears Wipe $150B From Crypto
Analyst Floats $13 As XRP’s ‘Most-Likely Region’