CertiK Warns DarkSword Exploit Kit Uses Six iOS Flaws to Target Crypto Wallets

CertiK Flags an Attack That Needs No Signature

Security firm CertiK warned in a Nov. 6 alert on X that a refreshed version of the DarkSword iPhone exploit kit can compromise unpatched iPhones and expose the crypto wallets stored on them, with no wallet connection and no transaction approval required. The firm wrote that simply opening a malicious page in Safari may be enough, and named MetaMask, Trust Wallet, Phantom, Exodus and Coinbase among the applications the kit reportedly targets, along with passwords and recovery phrases kept elsewhere on the device. The warning rests on an exploit chain Google Threat Intelligence Group documented in a March 18 report, which combined six vulnerabilities affecting iOS 18.4 through 18.7. Google identified three malware families deployed after successful exploitation, GHOSTBLADE, GHOSTKNIFE and GHOSTSABER, capable of harvesting wallet data, device keychains, Notes databases, browser records and personal media, and observed campaigns against users in Saudi Arabia, Turkey, Malaysia and Ukraine dating back to at least November 2025. Apple patched the flaws by the release of iOS 26.3, with most fixes shipped earlier.

@CertiKAlert · X post

Alert on X.

View on X

The kit has kept evolving. Mobile security firm iVerify disclosed a P7 DarkSword variant in an Oct. 8 report, after investigating an infection found on a customer device in August: the implant beacons its command server every 15 seconds by default, processes keychain data on the phone before transmission, and carries a dedicated command to identify installed wallet applications and extract imToken data. A separate Oct. 21 investigation by iVerify and Report URI traced distribution through malicious advertising, including a World Cup-themed Instagram ad that infected an employee while they scrolled their feed, and a campaign called DeadTag built on hundreds of re-registered analytics domains whose network drew an estimated 135 million monthly visits. A fake Polymarket page served two DarkSword variants, infecting vulnerable devices automatically as the page loaded. CertiK recommended a hardware wallet for significant holdings and Lockdown Mode for higher-risk users.

CZ Urges Updates as $5.57M Losses Surface

Binance co-founder Changpeng Zhao added a public call on Friday, using his X account to tell iPhone users to update their operating systems immediately, with a pointed message for anyone running a stale build: no wallet application can patch the system underneath it, and self-custody means the user carries the responsibility. His post followed estimates from the security researcher known as Officer's Notes that roughly $5.57 million in digital assets had already been taken through the flaw, spread across more than 18 websites hosting the malicious code. The same researcher reported the kit is sold online for about $30,000 and that one build ships a module built specifically to target the imToken wallet. Apple has already patched the six flaws the kit chains together, and Officer's Notes put iOS 18.6.2 as the last version DarkSword supports, which concentrates the danger on devices left unupdated for months. Still, the kit's code carries references to iOS 26 and 27, a hint its developers are preparing exploits for future system versions. The episode is not isolated: in September Apple fixed a CoreGraphics graphics-engine flaw it acknowledged may have been exploited in sophisticated attacks against specific individuals, and SlowMist and OKX earlier found malicious code in the FomoPeek application able to reach beyond its normal permissions on iOS. Practical guidance across the researchers converges on a short list: install the latest iOS from Settings, General and Software Update; never keep a recovery phrase in Notes, Photos or screenshots; and treat links circulating in Telegram groups and direct messages with suspicion. For a device that may already be compromised, the only clean fix is generating a new wallet on an updated machine and moving the balance across, never reusing the old phrase, a process our guide to recovering a compromised wallet covers step by step.

@cz_binance · X post

His X account.

View on X

Stale iPhones Are the Real Attack Surface

The load-bearing document here is the CertiK alert itself, which states the compromise needs neither a wallet connection nor a signature, upending the approval-flow habit most self-custody training relies on. Read against the recovery figures, the exposure concentrates on phones running iOS builds older than the patches Apple shipped through iOS 26.3, and most of the five named applications are phone-based hot wallets that hold keys the device can read. That makes hardware isolation, cold storage and seed-phrase hygiene, across all common types of crypto wallets, a stronger control than app choice. The references to iOS 26 and 27 inside the kit suggest this exploit family intends to keep evolving.