DarkSword Zero-Day iOS Exploit Actively Draining Crypto Wallets Worldwide

A critical new threat has emerged for cryptocurrency holders using iPhones. Dubbed DarkSword, the exploit chain targets multiple zero-day vulnerabilities in iOS versions 18.4 through 18.7, achieving full device compromise with absolutely no user interaction. The attack is being delivered through compromised websites in what security researchers classify as a watering-hole campaign — and it is already draining wallets at scale.

Google's Threat Intelligence Group confirmed on March 21 that DarkSword has been active since at least November 2025, deployed by a combination of commercial surveillance providers and state-sponsored threat actors. Ledger CTO Charles Guillemet stated unequivocally that the exploit is "already deployed at scale" and urged all crypto users on iOS to take immediate protective measures.

This is not a theoretical vulnerability. It is an active, in-the-wild exploit that has already compromised devices across multiple continents.

How the DarkSword Exploit Works

DarkSword is a zero-click watering-hole attack, which means victims do not need to tap a link, download a file, or approve any permission. Simply visiting a compromised website with a vulnerable iPhone is enough to trigger full device compromise. Here is the attack chain broken down step by step:

Stage 1: Watering-Hole Delivery

Attackers compromise legitimate websites frequented by cryptocurrency users — forums, news aggregators, DeFi dashboards, and airdrop claim pages. Malicious JavaScript injected into these pages silently fingerprints visiting devices. If the device runs a vulnerable iOS version, the payload is delivered automatically.

Stage 2: WebKit Memory Corruption

The first zero-day targets the WebKit rendering engine used by Safari and all iOS browsers. A specially crafted memory corruption exploit achieves arbitrary code execution within the browser sandbox. This stage requires no user interaction whatsoever — the page simply needs to render in the browser.

Stage 3: Kernel Privilege Escalation

A second zero-day vulnerability in the iOS kernel allows the attacker to escape the browser sandbox and gain root-level access to the device. At this point, the attacker has full control over all data, processes, and encryption keys stored on the device.

Stage 4: Credential and Seed Phrase Extraction

With root access, DarkSword targets cryptocurrency wallet applications specifically. It extracts private keys, seed phrases, and session tokens from popular mobile wallets including MetaMask, Trust Wallet, Coinbase Wallet, and Phantom. The stolen credentials are exfiltrated to attacker-controlled servers, and wallets are drained — often within minutes.

For users unfamiliar with how private keys and seed phrases work, our cold wallet glossary entry explains the underlying security model.

Who Has Been Affected

Google's Threat Intelligence Group has confirmed affected users in at least four countries: Ukraine, Saudi Arabia, Turkey, and Malaysia. However, the watering-hole delivery method means any iPhone user visiting a compromised website is at risk regardless of geography. The exploit does not discriminate by region — it discriminates by iOS version.

Reports from affected users describe wallets being drained within minutes of visiting seemingly legitimate websites. In several documented cases, hardware wallet users who had connected their Ledger or Trezor devices to compromised mobile apps also reported unauthorized transactions, though hardware wallets with proper air-gapped signing remain unaffected when used correctly. Our Ledger Nano X review covers the security model that protects against this class of attack.

2026: A Record Year for Crypto Crime

DarkSword does not exist in isolation. It arrives amid the worst year for cryptocurrency theft on record. According to blockchain security firms, $2.1 billion has already been stolen in the first three months of 2026, with January alone accounting for $127 million in losses. The pace of exploitation has accelerated dramatically compared to previous years.

Here is a summary of the most significant crypto security incidents in 2026 so far:

The Trust Wallet browser extension breach is particularly relevant in the context of DarkSword. At least $6 million was lost when attackers exploited a vulnerability in the browser extension, allowing them to intercept transaction signing. Combined with DarkSword's mobile wallet targeting, the message is clear: software wallets on internet-connected devices are under sustained, sophisticated attack.

How to Protect Yourself

The DarkSword exploit is serious, but it is not unstoppable. Here are the most effective steps crypto holders can take to protect their assets immediately:

1. Update iOS Immediately

Apple released emergency patches addressing the WebKit and kernel vulnerabilities exploited by DarkSword. If you are running iOS 18.4 through 18.7, update to the latest available version without delay. Go to Settings > General > Software Update and install any pending updates.

2. Move Assets to a Hardware Wallet

Hardware wallets like the Ledger Nano X or Trezor Safe 5 store private keys on a dedicated secure element that never exposes them to your phone or computer. Even if DarkSword fully compromises your iPhone, it cannot extract keys from a properly configured hardware wallet. Our wallet security guide walks through the setup process.

3. Revoke Unnecessary Token Approvals

If you have interacted with DeFi protocols, review and revoke any open token approvals using tools like Revoke.cash. An attacker who gains access to your wallet can exploit existing approvals to drain tokens even without your seed phrase.

4. Use a Dedicated Device for Crypto

Consider using a separate device exclusively for cryptocurrency transactions — one that does not browse the general web. This eliminates the watering-hole attack vector entirely.

5. Enable Advanced Data Protection on iCloud

If you use iCloud Keychain, enable Apple's Advanced Data Protection to ensure end-to-end encryption of your stored credentials. Without it, a compromised device could leak keychain data to attackers.

iPhone Security Checklist for Crypto Users

Use this checklist to audit your current iPhone security posture against threats like DarkSword:

Why Watering-Hole Attacks Are Especially Dangerous for Crypto Users

Traditional phishing attacks require the victim to click a malicious link or enter credentials on a fake website. Watering-hole attacks are far more insidious because they compromise websites the victim already trusts and routinely visits. A crypto trader checking their portfolio on a familiar DeFi dashboard has no reason to suspect the site has been silently weaponized.

This is what makes DarkSword qualitatively different from typical crypto scams. It does not rely on user error, social engineering, or deception. It exploits the fundamental act of browsing the web on a vulnerable device. For anyone new to the crypto security landscape, our beginner's guide to crypto covers essential security practices from the ground up.

The Broader Implications for Mobile Crypto Security

DarkSword represents a new chapter in the ongoing arms race between attackers and defenders in the cryptocurrency space. Several structural trends make this problem likely to intensify:

• Rising value, rising incentive: As crypto market capitalization grows, the financial incentive for sophisticated exploit development grows proportionally. State-sponsored actors and commercial surveillance firms are now investing resources into crypto-specific attack tooling.
• Mobile-first crypto adoption: The majority of retail crypto users interact with their assets primarily through mobile devices. This creates an enormous and growing attack surface that is difficult to secure at the operating system level.
• Zero-day market economics: iOS zero-day exploits command prices exceeding $2 million on the private market. When crypto wallets containing millions in assets can be drained through a single exploit chain, the economics of exploit development become extremely favorable for attackers.
• Lag in user security practices: Despite repeated warnings, the majority of crypto holders still store significant assets in software wallets on internet-connected devices without hardware wallet protection.

The cryptocurrency industry has long preached the mantra of "not your keys, not your coins." DarkSword adds a critical corollary: if your keys are stored on a compromised device, they are not truly yours either. The only reliable defense is keeping private keys on dedicated hardware that never touches the internet directly.

What Happens Next

Apple's security team is actively working to patch the remaining vulnerabilities in the DarkSword chain. Google's Threat Intelligence Group continues to track the exploit's deployment and has published indicators of compromise that security teams can use to detect affected devices. Ledger and other hardware wallet manufacturers have issued advisories urging users to verify transaction details on the device screen rather than trusting what appears on a potentially compromised phone.

For crypto users, the immediate priority is clear: update your iPhone, move significant holdings to a cold wallet, and treat any software wallet on a mobile device as a hot wallet with corresponding risk exposure. The DarkSword exploit is a sobering reminder that in the digital asset space, security is not optional — it is the price of participation.