A single visit to a malicious website could put an iPhone user’s cryptocurrency at risk. A campaign linked to the DarkSword iOS exploit has reportedly drained more than $4 million in crypto from hundreds of wallets, using compromised devices to access sensitive information.
Blockchain analytics firm Bitquery traced at least $4.06 million in USDT stolen from 365 wallets on the TRON network between October 5 and November 4. The investigation also identified more than $103,000 in losses across 65 wallets on eight other blockchain networks.
The findings highlight a growing security risk for crypto users who rely on their phones to store wallet information, access exchanges and manage digital assets.
How the DarkSword exploit works
DarkSword is an iOS exploit chain that takes advantage of security vulnerabilities to gain access to an iPhone through a malicious webpage.
Security researchers from Google, Lookout and iVerify documented the exploit in March 2026. Their findings showed that DarkSword could compromise vulnerable iPhones through Safari and collect sensitive information stored on the device.
Depending on the compromised device and the attack, the stolen information can include saved passwords, messages, photos, notes, credentials and cryptocurrency wallet data.
This creates a serious risk for users who store wallet recovery phrases in screenshots, notes or other files on their phones. Anyone who obtains a wallet’s recovery phrase can potentially restore the wallet on another device and take control of its funds.
Unlike a conventional crypto phishing attack, which often tricks a victim into connecting a wallet and approving a transaction, a device-level exploit can target information stored on the phone itself.
More than $4 million traced to stolen crypto
Bitquery’s investigation identified a network of 43 collection wallets linked to a single wallet used to pay transaction fees.
The attackers used these wallets to receive stolen funds from hundreds of victims. Investigators also identified activity involving eight other blockchain networks, suggesting that the campaign was not limited to TRON.
However, blockchain records alone do not establish how every affected wallet was compromised. While researchers have linked the broader campaign to DarkSword, the precise attack method may differ between victims.
The investigation underscores how attackers can use access to a compromised phone to target multiple crypto wallets without exploiting a separate vulnerability in each wallet application.
Which iPhones are at risk?
Google’s Threat Intelligence Group documented DarkSword activity targeting iPhones running iOS versions 18.4 through 18.7. Apple has released security updates addressing the vulnerabilities used in the documented exploit chain.
Users should update their iPhones to the latest iOS version supported by their device. Those using older devices that no longer receive security updates face additional risks.
Crypto users should also avoid storing recovery phrases or private keys in screenshots, photo libraries, messaging apps or unsecured notes. Recovery phrases should be kept offline in a secure location.
Anyone who suspects their phone has been compromised should use a trusted, updated device to secure their accounts and move remaining crypto assets to a new wallet with a newly generated recovery phrase. They should never enter their existing recovery phrase into a website or app claiming to scan or repair the wallet.
What crypto users should take away
DarkSword shows why protecting a cryptocurrency wallet involves more than choosing a reputable wallet application. The security of the phone holding wallet credentials matters just as much.
Users should be cautious when opening unfamiliar links, keep their devices updated and avoid storing sensitive wallet information where other applications or malware could access it.
The reported losses also serve as a reminder that a wallet can be compromised without its owner knowingly approving a suspicious transaction. For crypto users who manage significant funds on an iPhone, device security must be part of their overall wallet protection strategy.