Binance co‑founder Changpeng Zhao (CZ) and blockchain security firm CertiK issued coordinated warnings on November 6 urging iPhone users to apply the latest iOS updates. Both alerts cite the DarkSword exploit kit, which can harvest cryptocurrency wallet files, recovery phrases and other sensitive data simply by loading a malicious website in Safari, even when no wallet app is opened or transaction signed.

How DarkSword works on iOS

According to CertiK, the latest P7 variant of DarkSword strings together six iOS vulnerabilities documented by Google’s Threat Intelligence Group for versions 18.4 through 18.7. The exploit chain enables attackers to install spyware that scans for popular wallet apps such as MetaMask, Trust Wallet, Phantom, Exodus and Coinbase, extracts keychain entries, and can execute remote commands. Researchers observed that malicious advertisements—sometimes embedded in Instagram feeds—can trigger the infection automatically when a vulnerable device renders the ad content.

Impact and reported losses

Threat researcher Officer’s Notes previously estimated that roughly $5.57 million in crypto had already been stolen via DarkSword, with more than 18 compromised websites distributing the code. The exploit kit has been listed for sale at around $30,000, with the seller noting support for iOS 18.6.2 and placeholders for future firmware versions, suggesting ongoing development.

CZ emphasized that wallet applications cannot update a phone’s operating system, stating, “Self‑custody means self‑responsibility.” He urged all iPhone owners, especially those who have not updated in months, to install the latest iOS release via Settings → General → Software Update. CertiK echoed this advice and added specific actions: move any exposed funds to a new wallet with a fresh recovery phrase, keep seed phrases out of Photos, Notes or screenshots, consider hardware wallets for large balances, and enable Apple’s Lockdown Mode where possible. For devices suspected of compromise, CertiK recommends resetting the phone, reinstalling apps, and never reusing the old seed phrase.

What to watch next

Analysts will monitor whether Apple releases additional patches beyond iOS 26.3 and how quickly users adopt them. The persistence of DarkSword’s code reuse, especially targeting imToken and other niche wallets, suggests that threat actors may continue to refine the kit for newer iOS releases. Follow‑up reports from Google, iVerify and other security firms are expected to clarify the scale of ongoing campaigns and any links to state‑sponsored actors.