DarkSword iPhone Exploit Can Drain Crypto Wallets With One Bad Link, CertiK Warns

Security firm CertiK dropped a warning Nov. 6 about DarkSword, an iPhone exploit that can hand over crypto wallet credentials to an attacker the moment a victim opens a poisoned Safari page. No wallet connection, no transaction approval, no sketchy file download — just a visit to the wrong link. Devices still running iOS 18.4 through 18.7 are the ones exposed.

DarkSword doesn't rely on a single flaw. It chains six system-level vulnerabilities together, according to CertiK's alert, climbing past iOS protections and planting software that quietly hoovers up data. The shopping list is ugly: wallet private keys and recovery phrases, passwords stashed in the iPhone Keychain, plus photos and notes.

CertiK flagged five mobile wallets as sitting in the blast radius: MetaMask, Trust Wallet, Phantom, Exodus and Coinbase Wallet. That's a who's-who of self-custody apps, which means the loot here is seed phrases — the master keys to a user's entire holdings.

The fix is straightforward, if not glamorous: update iOS. CertiK told affected users to grab the latest Apple release and said anyone facing targeted attacks should switch on Lockdown Mode, which trims down what a compromised page can reach. The firm also warned against keeping recovery phrases in screenshots, notes or cloud services, where malware can simply read them off.

DarkSword isn't brand new. The exploit was documented earlier this year, and an October variant dubbed P7 added two-way remote-control capability — meaning an attacker could not just pull data out, but issue commands back in. That escalation turns a data grab into hands-on control of a compromised phone.

For now, the practical takeaway lands on the user: an unpatched iPhone plus one bad Safari link equals a possible drained wallet, with no taps required in between.