DarkSword iOS Exploit Reportedly Drains $5.57M From Crypto Wallets

TronWeekly reports that Changpeng Zhao, commonly known as CZ, urged cryptocurrency users to update their iPhones because a wallet cannot protect a device running an outdated operating system. His warning followed reports of a DarkSword exploit that allegedly removed $5.57 million from more than 20 crypto wallets. According to TronWeekly, the attacks occurred through Safari and did not require users to connect a wallet or approve a transaction signature. Crypto.news reported that CertiK issued a Nov. 6 warning about attackers using a newer version of the DarkSword iOS exploit kit. The research firm said malicious actors were targeting crypto wallets on unpatched iPhones and that visiting a specially crafted Safari page could potentially be enough to compromise a device. This places the reported threat at the browser and operating-system layers rather than inside the wallet interface itself. The three outlets corroborate the broad risk but emphasize different aspects of it. TronWeekly focuses on the reported financial loss, the number of affected wallets and the absence of a wallet connection or signature. Crypto.news provides the latest warning from CertiK and highlights the updated exploit kit, while DailyCoin describes the vulnerability as zero-click and says it can drain stored recovery phrases. DailyCoin did not provide an additional loss figure in the supplied coverage.

The distinction between compromising the iPhone and compromising a wallet is central to the reports. A malicious Safari page may be able to reach information held on the device, including recovery phrases, without asking a user to interact with a wallet or sign a transaction. CZ’s position is that application-level wallet protections are insufficient if the underlying iPhone remains unpatched, while CertiK’s warning indicates that the exploit tooling is continuing to evolve.

The broader crypto market was comparatively subdued at the time of the reporting. Total market capitalization stood at $2.62 trillion, with the overall market described as flat. Bitcoin was down 0.48% over 24 hours, while the Fear and Greed Index registered 28, placing sentiment in the “Fear” zone. No cryptocurrency was specifically identified as responsible for or directly affected by the reported iOS exploit.

The development makes device patching and the security of stored wallet recovery data relevant considerations for iPhone users. The reported loss total and affected-wallet count come from TronWeekly, while CertiK’s Nov. 6 warning indicates that a newer DarkSword version was already circulating. What remains important to monitor is whether updated iOS software disrupts the exploit path, whether additional affected wallets or losses are disclosed, and whether reported attacks continue to use Safari pages without requiring wallet signatures.