CZ Urges iPhone Users to Update iOS Amid DarkSword Threat

The threat has raised concerns about self-custody security, especially considering that the reported attack can target sensitive device data even without victims connecting their wallets or approving transactions. DarkSword reportedly targets information stored across an infected iPhone, making ordinary browsing a potential security risk for crypto holders.

DarkSword Exploit Details

In a November 6 post on X, CZ told users to install the latest iOS updates, especially those who have not updated their devices in a while. Furthermore, he reminded crypto holders that wallet apps cannot update a phone's operating system.

A crypto user pointed out that an attack wouldn't even need a wallet connection, transaction signature, or approval, with just a simple visit to an infected website being enough to expose sensitive information such as wallet files and recovery phrases stored in the device.

Officer's Notes, a threat researcher, had earlier reported that about $5.57 million worth of crypto had already been stolen through the vulnerability, with more than 18 websites allegedly involved in distributing the malicious code.

Apple Response

Officer's Notes pointed out that Apple had already patched all vulnerabilities, numbering six, that had been used in the known exploit chain. However, the wallet-targeting code is still relevant since parts of the older version could still be reused, with one iteration featuring a dedicated function for the imToken wallet.

The researcher also noted that DarkSword was being sold online for $30,000, with the seller listing iOS 18.6.2 as the latest supported firmware. Researchers have reportedly found placeholders for iOS 26 and 27, suggesting the infrastructure is being prepared for potential future exploits.

Previous iPhone Security Incidents

There have been other iPhone security incidents that resulted in stolen crypto, including a vulnerability in Apple's 2D rendering engine, CoreGraphics, which allowed malicious code to run when processing specifically crafted files. Apple addressed this with iOS 26.7.1 and iPadOS 26.7.1 in late September.

Another case involved the FomoPeek app, where SlowMist and OKX security reportedly found malicious code that could exploit iOS weaknesses and access sensitive information beyond the app's normal permissions.