A sophisticated exploit kit targeting iPhones, known as DarkSword, has allowed hackers to steal more than $4 million in cryptocurrency from 365 TRON wallets, according to data analytics firm Bitquery. The mobile device attacks required no user interaction, as the zero-click chain operates entirely through unpatched Safari browser vulnerabilities on iOS devices.
DarkSword: Exploiting iOS Safari Vulnerabilities
Researchers stated that DarkSword links together six separate security flaws affecting iOS versions 18.4 through 18.7. By luring users to malicious websites via the Safari browser, attackers could penetrate Apple’s security barriers and extract private keys, seed phrases, passwords, and message content stored in the device’s Keychain.
Unlike traditional cyberattacks, DarkSword does not require downloading a malicious app or manually approving wallet transactions. Instead, the kit automates the entire process, accessing sensitive wallet credentials without any notification, confirmation, or action by the device owner.
On March 18, 2026, Google’s Threat Intelligence Group, along with security firms Lookout and iVerify, released a detailed technical account of the exploit. Their studies indicate that DarkSword can retrieve account recovery information by searching through device photos and note-taking applications, making wallets that store credentials on-device particularly vulnerable.
Censys, a separate cybersecurity research firm, reported that DarkSword targets at least 18 crypto wallet apps, including MetaMask, Phantom, Trust Wallet, and Coinbase. However, they emphasized that the core vulnerabilities are within the iOS operating system itself, not the individual apps.
Mini dictionary: Censys is a cybersecurity company specializing in internet-wide scanning and analysis of network vulnerabilities and threats. Their research supports organizations in identifying critical weaknesses across web and blockchain environments.
How Hackers Drained $4 Million in USDT
Bitquery’s forensics linked thefts to a network of 43 collection addresses, which were coordinated through a single fee wallet. Funds were systematically transferred from 365 compromised TRON wallets between October 5 and November 4.
| Metric | Value |
|---|---|
| Total wallets compromised | 365 |
| Total USDT stolen | $4.06 million |
| Median loss per wallet | $1,029 |
| Number of wallets losing >$100,000 | 8 |
| Share of losses from top 8 wallets | 63% |
Eight wallets each lost more than $100,000, representing nearly two-thirds of the total USDT drained. The attackers first sent victims small amounts of TRX, likely as part of the attack process, before emptying the wallets.
Bitquery managed to trace the entire activity back to an initial transfer that matched details of a previously reported iPhone theft. However, blockchain records alone could not reveal the identities of victims or their specific wallet applications.
Bitquery concluded that “for compromised seed phrases, changing wallet passwords or revoking token approvals is not sufficient—users must generate a new recovery phrase and transfer assets to a new wallet.”
Security Measures and Recommendations
Apple has since issued security updates designed to patch the vulnerabilities used in the DarkSword exploits. Google’s security team recommends users update their iOS devices immediately or enable Lockdown Mode if updating is not possible.
Experts also advise storing wallet seed phrases offline instead of in device photos, notes, or cloud storage. Holding significant crypto holdings in a hardware wallet is recommended for stronger protection.
Anyone receiving unexpected TRX deposits from unknown sources should treat these as warning signs. Unlike phishing attacks that require user approval, a compromised seed phrase could be used from a different device to empty an entire wallet instantly, making protection of recovery phrases essential.
For users whose seed phrases are exposed, security teams stress the need to generate a new wallet rather than trusting password changes or transaction approval controls to mitigate ongoing risks.
