iPhone Attack Kit 'DarkSword' Suspected of Being Misused for Cryptocurrency Theft, Bitquery Identifies Approximately $4.06 Million in Stolen Funds

Key Points of This Article

• Seed exploration from photos and notes, stealing private keys without approval
• Approximately $4.06 million moved from Tron’s 365 wallet, connections are unconfirmed

Attack Kit That Steals Seeds Without Approval

An attack kit called "DarkSword," which exploits vulnerabilities in iPhones, is suspected of being misused for theft from cryptocurrency wallets. Blockchain analysis firm Bitquery announced on the 5th that at least $4.06 million (approximately 640 million yen) worth of USDT had been moved from 365 wallets on Tron (TRON) through a suspected theft network.

DarkSword primarily targets iPhones running iOS versions 18.4 to 18.7. The attack can be executed simply by opening a tampered website in Safari, prompting researchers to urge users to update their iOS to the latest version.

On March 18, Google’s Threat Intelligence Group (GTIG) and security firms Lookout and iVerify simultaneously published analyses regarding DarkSword. The attack combines six vulnerabilities to take over devices, extracting passwords, messages, and data from cryptocurrency wallet apps stored in the keychain, without requiring downloads or user approval for actions.

According to a report published by security firm Censys in October, the kit contains modules that specifically target 18 wallet apps and has the capability to search for seeds (recovery phrases) from photos and notes apps. Targeted apps include MetaMask, Phantom, Trust Wallet, and Coinbase.

These attacks do not exploit flaws in the apps themselves but rather target vulnerabilities on the device side, with Censys analyzing that the primary goal is wallet theft.

Attackers use the stolen private keys and seeds to sign and send transactions from their own devices. A significant difference from traditional phishing, which requires unauthorized approvals, is that no wallet connections or transaction approvals occur on the victim's side.

Revoking approvals or reinstalling apps does not prevent theft, and if seeds are stolen, the only way to protect funds is to transfer assets to a wallet created with a new seed.

Approximately $4.06 Million Moved on Tron

Bitquery traced the flow of funds starting from a transaction that matched the amount and time reported by an iPhone user who experienced theft.

From October 5 to November 4 (UTC), 43 collection addresses connected to the same fee wallet moved funds from the 365 wallets (89 of which were solely TRX losses). The median loss for 276 addresses that lost USDT was $1,029, with eight addresses that lost over $100,000 accounting for 63% of the total USDT losses.

However, Bitquery stated that it could not confirm that all losses were due to the iPhone vulnerabilities or DarkSword, as on-chain records do not reveal the devices or wallet apps of the victims. It has not yet been confirmed whether users in Japan have been affected.

To send USDT on Tron, TRX is required as a fee. According to Bitquery, a small amount of TRX was first sent to the victim's address, followed by the transfer of the entire balance a few seconds later. Receiving a small amount of TRX from an unknown address can serve as a warning signal.

Small incoming amounts can also involve a technique called address poisoning, which lures users into mistakenly sending funds by mixing similar addresses into their transaction history. In either case, it is essential not to copy the recipient address from transaction history.

Updated iOS and User Countermeasures

The six vulnerabilities exploited by DarkSword have been patched in iOS 26.3 and addressed in version 18.7.7 of iOS 18. Apple released iOS 27.2 on October 26, fixing over 160 vulnerabilities.

On the same day, iOS 26.7.2 was provided for devices that had not transitioned to iOS 27, as well as iOS 18.7.11 for older devices like the iPhone XS and XR. Updates can be performed from the "Software Update" section under "General" in the "Settings" app. Notifications for updates displayed in the browser may be fraudulent.

For users of self-custody wallets, how they store their seeds can significantly affect their risk of theft. It is recommended to avoid storing seeds in photos, screenshots, notes apps, or the cloud, and instead keep them offline on paper or metal plates.

Seeds that were previously photographed may still be present in iCloud photos, "Recently Deleted Items," or iCloud backups. Managing substantial assets with a hardware wallet while keeping only the amount used daily on a smartphone is also a viable strategy.

If seeds were stored on the device or if there is a possibility of having opened suspicious sites on a vulnerable iOS, it is advisable to create a new seed wallet on a trusted device that has been updated and transfer assets. Bitquery also urges users to move their assets immediately if they receive small amounts of TRX from unknown addresses.

Users of exchange apps are not exempt either. Since passwords stored in the keychain can be stolen, changing the exchange password is an option if they were using a vulnerable iOS.

For two-factor authentication, using authentication apps or passkeys is preferable to SMS, and some exchanges allow setting registration restrictions for withdrawal addresses. Individuals holding large amounts of cryptocurrency or industry professionals should also consider enabling lockdown mode. GTIG recommends enabling lockdown mode as a countermeasure for devices that cannot be updated.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.