iPhone Wallet Theft Probe Traces $4.06 Million in TRON Drains

A crypto-theft network identified during an investigation into a reported iPhone wallet attack drained 365 TRON addresses, taking at least $4.06 million in $USDT between Oct. 5 and Nov. 4, according to Bitquery.

Researcher Gaurav Agarwal linked 43 collection wallets through a shared wallet used to pay transaction fees. Bitquery matched one theft to an iPhone owner's published account, but could not identify the phone or exploit behind the other losses. The study does not establish a DarkSword-specific loss total.

The network's pattern was to send a victim enough $TRX to pay fees, then move out the $USDT balance and remaining $TRX, Bitquery said. In one Oct. 25 case, a wallet received 18 $TRX and sent its entire 519,093-$USDT balance to a collector 18 seconds later.

Bitquery also estimated losses of at least $103,000 from 65 additional wallet addresses on eight other blockchains in the linked network. Its TRON estimate counts only $USDT transfers that took an address's entire $USDT balance, excluding partial drains.

A Webpage Can Expose Wallet Keys

On a vulnerable iPhone, simply loading a malicious page in Safari can trigger exploitation without further interaction, according to SlowMist's analysis. Google's investigation describes how DarkSword chains six vulnerabilities to execute code, escape Safari's sandbox—the restrictions separating web content from the rest of the phone—and gain access to system memory.

SlowMist found toolkit code designed to extract saved credentials and read local wallet databases. Targets include Trust Wallet, MetaMask, imToken, TokenPocket, TronLink and OKX. If attackers obtain usable private keys or recovery phrases, they can sign transfers on another device without the victim connecting a wallet or approving a transaction.

In a Nov. 6 advisory, Trust Wallet listed DarkSword's target range as iOS 18.4 through 18.7, and the separate Coruna exploit kit's as iOS 13.0 through 17.2.1. “They don’t rely on a flaw in any wallet app,” it said, warning that compromised devices can expose locally stored wallet data.

SlowMist also found modified toolkit code routing devices through iOS 18.7.2, but cautioned that claimed version support was not proof of successful exploitation on every version.

Patches are already available. Google says all vulnerabilities used in the DarkSword chain were fixed by the release of iOS 26.3. Apple says iOS 18.7.7 provides protections against DarkSword web attacks. Trust Wallet recommends installing the latest iOS version available for the device, using Lockdown Mode if an update is not possible, and keeping recovery phrases out of screenshots and notes apps.

For suspected compromise, SlowMist recommends creating a new wallet with a new recovery phrase on a clean device and transferring remaining assets. Old recovery phrases and private keys should be treated as compromised and never reused.