A silent zero-click exploit chain targeting iPhones has drained more than $4 million in cryptocurrency across 365 TRON wallets, according to a report by Bitquery.
Dubbed DarkSword, the sophisticated attack kit compromises unpatched iOS devices through Safari—allowing hackers to extract private keys and seed phrases without requiring a single transaction signature or app download.
Inside the DarkSword Exploit: How the Zero-Click iPhone Attack Works
DarkSword, a kit for hacking iPhones, chains six iOS vulnerabilities to hijack devices running iOS 18.4 through 18.7. It compromises vulnerable iPhones through malicious websites opened in Apple’s Safari browser.
Sponsored
The exploit chain combines multiple security vulnerabilities to gain access to sensitive device information without requiring users to download an application or authorize a wallet transaction.
Google’s Threat Intelligence Group (GTIG), together with cybersecurity firms Lookout and iVerify, published technical analyses of the exploit on March 18, 2026. Their findings describe an attack chain capable of accessing passwords, messages, and cryptocurrency wallet information stored in Apple’s Keychain.
A separate investigation by cybersecurity firm Censys identified modules targeting 18 cryptocurrency wallet applications. The toolkit can reportedly search photos and note-taking applications for recovery phrases, potentially exposing wallets whose credentials were stored on the device.
Targeted applications reportedly include MetaMask, Phantom, Trust Wallet, and Coinbase. The vulnerability lies in the iPhone’s operating system rather than the individual wallet applications.
Unlike conventional phishing attacks, DarkSword does not necessarily require victims to connect their wallets or approve suspicious transactions. Attackers who obtain a private key or recovery phrase can use another device to sign and broadcast transactions.
$4M Drained: Breakdown of the TRON Wallet Losses
Bitquery’s investigation identified a network of 43 collection addresses connected through a shared fee wallet. The addresses received funds from 365 TRON wallets between October 5 and November 4.
The investigation found that at least $4.06 million in USDT was transferred. Of the 365 wallets affected, the median loss was $1,029. Eight wallets lost more than $100,000 each, accounting for 63% of the total USDT losses. The attackers reportedly sent small amounts of TRX to victims’ wallets shortly before draining their balances.
Bitquery traced the transfers back to an initial transaction whose amount and timing matched those of a publicly reported iPhone theft. However, blockchain records cannot reveal which devices or wallet applications individual victims were using.
How to Secure Your iPhone and Crypto Wallets Now
Apple has released security updates addressing the vulnerabilities used by DarkSword. Google recommends installing the latest available iOS version or enabling Apple’s Lockdown Mode when an update is not possible.
Cryptocurrency holders should also:
- Store recovery phrases offline rather than in photographs, screenshots, Notes, or cloud storage.
- Use hardware wallets for larger cryptocurrency holdings.
- Avoid copying recipient addresses directly from transaction histories.
- Treat unexpected TRX deposits from unknown addresses as potential warning signs.
Changing wallet passwords or revoking token approvals is not sufficient if attackers already possess the recovery phrase. A compromised seed requires generating a new one and transferring the assets.
Why This Matters
DarkSword device-level attacks bypass wallet approval checks, so exposed seed phrases can lead to total loss without a single signature from the victim.
Explore DailyCoin’s popular crypto news today:
Bitcoin Tumbles to $75K as AI Fears Wipe $150B From Crypto
Analyst Floats $13 As XRP’s ‘Most-Likely Region’