DarkSword Safari Exploit Puts Unpatched iPhone Wallets at Risk

CertiK warned iPhone users about DarkSword, an exploit kit that security researchers and crypto-focused outlets say can expose cryptocurrency wallets on vulnerable devices. The primary attack route uses Apple’s Safari browser and malicious websites, allowing attackers to access sensitive device information and potentially compromise stored wallet credentials without asking the victim to connect a wallet or approve a transaction. Crypto.news reports that attackers are using a newer version of the DarkSword iOS exploit kit against crypto wallets on unpatched iPhones. Its warning says a malicious Safari page may be enough to compromise a device, while DailyCoin describes the browser vulnerability as zero-click and says it targets stored recovery phrases. Those details make the browser rather than the wallet interface the central point of exposure. The four outlets broadly agree on the danger posed by the exploit, although they emphasize different aspects. CoinEdition, TronWeekly, Crypto.news and DailyCoin all connect DarkSword with vulnerable iPhones, Safari or browser activity and potential crypto theft without a normal wallet connection or transaction signature. CoinEdition and Crypto.news both identify CertiK as the source of the warning and reference its Nov. 6 post. TronWeekly adds the most concrete account of reported losses: $5.57 million stolen from more than 20 wallets through Safari on iOS. It also reports that Changpeng Zhao urged crypto users to update their iPhones, arguing that a wallet cannot protect an outdated operating system. That loss figure and Zhao’s response were not repeated in the other supplied summaries. The market backdrop is subdued rather than showing a clear crypto-wide reaction to the warning. Total crypto market capitalization stands at $2.61 trillion, with the broader market described as flat, while Bitcoin is down 0.25% over 24 hours. The Fear & Greed index is at 28, placing sentiment in the “Fear” zone. No specific coin associated with the affected wallets was identified in the supplied coverage. The immediate issue is whether users have patched the relevant iOS vulnerability and whether Safari has been exposed to malicious pages through DarkSword. The mechanism is notable because it reportedly bypasses the familiar requirement to connect a wallet or sign a transaction, so device updates and the security of stored recovery phrases are central details to watch. The coverage does not identify every technical indicator, affected software version or defensive step, and no broad market movement can be tied specifically to the exploit from the available data.