DarkSword: iPhone hacked through a website and your crypto wallet

What DarkSword is

It is a ready-made iPhone hacking kit reported in March 2026 by Google Threat Intelligence Group, Lookout and iVerify. It was planted on real hacked websites and on fake pages: a person opened a link in Safari, and on a vulnerable iOS version the phone was compromised without a single “allow” tap.

The targets were iPhones on iOS 18.4–18.7 without the latest fixes. Apple has already closed these vulnerabilities. iVerify estimated that at the time of publication about 14% of iPhones worldwide were on a vulnerable version.

Who is at risk

Confirmed attacks targeted people in Ukraine, Saudi Arabia, Turkey and Malaysia. The kit was used both by state-linked groups and by commercial spyware vendors.

But DarkSword deliberately searches for crypto wallets, and researchers openly name a financial motive among its operators. Such kits are resold and reused, so anyone holding USDT or bitcoin on an old iPhone is a suitable target, wherever they live.

What it takes from the phone

• Passwords from the iPhone keychain, including passwords for websites, exchanges and Wi-Fi.
• Messages: SMS, iMessage, WhatsApp, Telegram, plus contacts and call history.
• Safari history and cookies — that is, logged-in exchange and email sessions.
• Notes, calendar, photo data, location and account details.
• Crypto app data. Its search list includes Coinbase, Binance, Kraken, Bybit, OKX, Trust Wallet, MetaMask, Exodus, Ledger, Trezor, SafePal, TokenPocket and others, plus any app with the words “wallet”, “crypto” or “bitcoin”. TRON wallets fall under this rule too.

If your seed phrase was in notes, in a screenshot or among saved passwords, assume it may have been taken.

Signs: why there are almost none

DarkSword does not install itself for the long term: it grabs the data in seconds or minutes, deletes its temporary files and exits. The battery doesn’t drain, no icons appear, and nothing is left after a restart.

A weak hint is Safari closing or crashing several times in a row when opening one site. That also happens without a hack, so rely not on signs but on two questions: which iOS version you had before March 2026, and where your seed phrase was kept.

What to do now

1. Update iOS. Settings → General → Software Update. Install the latest available version and turn on automatic updates. iVerify recommends no lower than iOS 18.7.6 or 26.3.1.
2. Your phone no longer gets updates? Don’t keep a funded wallet on it and don’t log in to an exchange from it.
3. Turn on Lockdown Mode if you hold large sums or work with crypto: Settings → Privacy & Security → Lockdown Mode. According to the researchers, it stops DarkSword. Some website and messaging features are limited in this mode.
4. Remove your seed phrase from the phone: from notes, photos, the cloud and the password manager. Keep it on paper or metal, and large sums on a hardware wallet, see how to store a seed phrase.
5. Protect exchange accounts: two-factor protection with an app or a key, not SMS, and a withdrawal address whitelist.
6. Don’t open links from strangers and don’t install apps outside the App Store.

If your seed phrase or passwords were on a vulnerable iPhone

1. On an updated device, create a new wallet with a new seed phrase and move everything there. Stop using the old address.
2. Change your exchange, email and Apple ID passwords and end all active sessions.
3. Check the old address in GuardPay /check: the transfer history shows whether money left without you.
4. If money is already gone, start a trace in GuardPay /stolen and read what to do if your wallet is hacked. Beware of “recovery agents” who write first, see recovery scams.