The post Google warns over 200 million iPhone crypto wallets at risk appeared on BitcoinEthereumNews.com.

Google just disclosed a vulnerability that targets iPhone crypto wallets and could have affected an estimated 270 million Apple devices. The DarkSword exploit, which strings together multiple zero-day vulnerabilities, is still live today and affects iPhones running iOS 18.4 through 18.7, updates that were released between April and September last year. Up-to-date Apple devices use iOS 26.3.1. However, because many people don’t automatically upgrade, 24% of all iPhones still use iOS 18 according to Apple’s own data. DarkSword allows hackers to orchestrate six vulnerabilities together to silently compromise devices, dump their Keychain databases, and vacuum up crypto wallet data.  Frequently targeted apps by DarkSword hackers include crypto wallets MetaMask, Phantom, and dozens of others by Coinbase, Ledger, and more. Visiting a poisoned website in Safari is all it takes to trigger the attack. Google’s Threat Intelligence Group has observed Russian state-linked hackers, a Turkish surveillance vendor, and another threat cluster wielding DarkSword against targets in Saudi Arabia, Turkey, Malaysia, and Ukraine since at least November 2025. Read more: Legacy DeFi platforms lose $27M as hacking spree continues into 2026 Zero-day access to iPhone crypto wallet files DarkSword isn’t a keylogger or clipboard sniffer; it gains kernel-level access, then injects JavaScript into privileged iOS system processes to pillage the device. The sinister toolkit hunts specifically for crypto wallet files, scanning for apps matching terms like “metamask,” “ledger,” “trezor,” “phantom,” “coinbase,” “binance,” and “kraken.” It grabs whatever wallet data it finds. It can also pull the device’s Keychain database which is an Apple system-level storage service for passwords.  DarkSword can also access WiFi passwords, iCloud data, Safari cookies, iMessages, WhatsApp histories, call logs, location histories, photos, and encryption keys protecting stored credentials called keybags. Google disclosed that the DarkSword iOS exploit chain has been widely used since late 2025 to compromise iPhones…

---

Filed under: News - @ March 20, 2026 6:27 pm