A dark, unbranded phone lying flat on a black surface, with a thin crack of red light running across its screen and on to a plain gold coin floating beside it
Original AI-generated illustration; not a real device.

DarkSword's iPhone Exploit Works on Two iOS Ranges. Here's How to Check Whether Your Bitcoin Wallet Is Exposed

NodeWitness Team 9 min read

A toolkit built from public exploit code is now live on more than 1,500 phishing sites, according to SlowMist, and it is hunting crypto wallets on unpatched iPhones. Whether yours is exposed comes down to one number in Settings and one question about the links you have opened.

On Saturday morning, blockchain security firm SlowMist issued an alert aimed at anyone holding crypto on an iPhone or iPad [1]. Its MistEye threat intelligence system had identified more than 1,500 phishing sites tied to DarkSword, posing as online shops, Binance, OKX, crypto wallets, games and exchange services [1][4]. Once it lands, the kit uses iOS flaws to break out of the app sandbox and collect keychain credentials, wallet private keys stored on the device and Notes data [1].

Start with the version number

Open Settings > General > About and look at the iOS Version line. That number decides most of what follows.

SlowMist's technical report from October 19 draws a hard line between what the kit advertises and what it can actually do [2]. Its landing pages accept any iPhone on iOS 13 or later, and its payload library carries version labels up to iOS 26.6.1. The code, however, confirms only two ranges where every stage of the attack chain is in place [2].

According to SlowMist's analysis, DarkSword's full chain works on iOS 18.6 through 18.7.2 and on iOS 26.0 through 26.1 [2].

Your iOS SlowMist's reading of the code What to do
iOS 26.0 to 26.1 Full chain works Update now, then review which links you opened
iOS 26.2 Exploit unverified Update
iOS 26.3 or later, and iOS 27 No working entry exploit, per the attackers' own notes Stay on the latest release
iOS 18.6 to 18.7.2 Full chain works Update now, then review which links you opened
iOS 18.7.3 or later Patched, per the attackers' own notes Install the newest 18.7 build available
iOS 18.4 to 18.5 Routed into the chain, which is incomplete there Update

The attackers documented those limits themselves. Their iOS 18 delivery code carries the comment "18.7.3+ is patched", and the routing file for iOS 26 says "No surviving vulnerabilities in 26.3+" [2]. iOS 26.2 is flagged as unverified [2].

Google Threat Intelligence Group, which disclosed DarkSword on March 18, described the original chain as covering iOS 18.4 through 18.7 and said all six of its vulnerabilities were fixed by iOS 26.3, most of them earlier [7]. Apple patched two of the WebKit flaws in the chain on December 12, 2025, in iOS 26.2 and iOS 18.7.3 [10].

Then update, all the way

Settings > General > Software Update. Apple says devices running current software were not at risk from these web attacks, and that Safari's Safe Browsing blocks the malicious domains identified so far [8]. For most models the newest builds are iOS 27.0.1 and iOS 26.7.1, both released on September 28 [11]. Anyone who stayed on iOS 18 with a phone that could run iOS 26 has a path too: on April 1, Apple widened iOS 18.7.7 to more devices specifically to deliver the DarkSword fixes [9].

Getting just outside the danger ranges is not the goal. SlowMist found eleven files in the kit's library built around CVE-2026-43818, an integer overflow in HEIF image parsing that affects iOS 15.8.8 through 26.5.2 and was not fixed until iOS 26.6 [2]. The attackers mark it as untested on real devices [2], which is exactly the kind of work in progress that the latest release closes off.

If your phone cannot run a recent version, Apple recommends Lockdown Mode, which it says protects against these specific attacks even on out-of-date software [8].

Why a bitcoin holder should care

The wallet apps DarkSword targets by name are mostly multi-chain: imToken, TokenPocket, TronLink, MetaMask, OKX, Coinbase, Exodus, BitKeep, Gate and Trust Wallet [2]. Several of them hold bitcoin. No bitcoin-only wallet appears on the list SlowMist published, but the kit's reach goes well past wallet apps.

After a successful compromise, SlowMist says the payload can pull the keychain, Notes, the photo library, SMS messages and Wi-Fi passwords, among other data [1][2]. A seed phrase saved in Notes, or a screenshot of the backup screen, is as exposed as any wallet file.

The attackers built the cash-out into the same tool. The panel includes a mnemonic management page listing recovered phrases, private keys, derived addresses and on-chain balances, with a one-click option to consolidate funds [2]. As our review of this year's three hardware wallet attacks showed, the weak point tends to be the seed rather than the chip. A seed that lives only on a hardware wallet and on paper never sits on the phone for DarkSword to find.

Inside the attackers' panel

SlowMist traced live admin panels and matched them to DarkSword-PROV2, a package that appeared on GitHub in July bundling the exploit chain, a delivery server, an admin panel and documentation [2]. According to the report, the repository's documentation points buyers to a Telegram account for a paid PRO version, with technical support priced at 5,000 USDT [2].

In the 30-day window SlowMist examined, the panel recorded 20,187 page visits, 1,187 exploit attempts and 10 successful exploits, nine of which ended in data exfiltration [2].

That is a small hit rate for that much traffic. The device list showed 57 phones in Australia, Malaysia, Latvia, South Korea, Ukraine, China's Jiangxi province and Hong Kong [2]. SlowMist cautions that appearing on the list does not mean a phone was compromised: some were running iOS 26.3 or later and had only registered with the landing page [2].

How it reaches you

The panel's landing-page templates include crypto giveaways, WhatsApp verification, iOS system updates, iCloud Photos and Apple ID sign-in [2]. Among the decoys SlowMist found were a supposed AI stock analyzer and a luxury watch buying site that fires the exploit as soon as the page loads, with no tap required [2].

Links are not the only route. SlowMist founder Yu Xian warned that some apps already installed on iPhones may have been poisoned [3]. The report details how versions 1.1 and 1.2 of FomoPeek, distributed through the official App Store, carried an embedded iOS kernel exploit module between September 9 and 17 [2].

A crypto news site was caught up as well. SlowMist's chief information security officer, 23pds, said the Chinese-language outlet BlockBeats had been serving the DarkSword chain [4]. BlockBeats later confirmed that on October 22 a page on its mobile site had been copied and injected with a script from an outside domain, and said it has been cleaned up [5]. Security firm GCSA, which also alerted the outlet, says it watched that script load on the mobile site's search results page for "bitcoin" [6]. GCSA adds that a script loading is evidence of an attempt, not proof that any phone was compromised [6].

If you opened a suspicious link

Updating stops the next attack. It does nothing about data already copied [6]. If your iPhone was inside one of the two ranges and you opened a dubious link in Safari, SlowMist says to treat it as a credential compromise [2]. For a bitcoin holder, its guidance comes down to four steps:

  1. From a device that has never visited the page, create a wallet with a brand-new seed. A hardware wallet fits that description [2].
  2. Move all funds to it and consider the old seed and keys burned for good [2].
  3. Look for transfers you don't recognize and, on other chains, revoke token approvals you no longer need [2].
  4. Keep your Safari history, crash logs and any unusual transactions in case you need them later [2].

Restoring the old seed on a new phone does not help, because it brings back the same wallet [6]. One line from SlowMist's alert applies whether or not you clicked anything: never store seed phrases in Notes [1]. If you also use Electrum on a computer, upgrade to 4.8.3: a malicious server can show you a fake payment and wait for you to bump its fee, as our piece on the flaw explains. More of our self-custody coverage is collected in the privacy and self-custody section, and the case of an implant that read seeds straight off a device's screen is in our piece on the CryptoBilis Ledgers.

How many of the 1,500-plus sites are still up is unclear. SlowMist says the campaign's domain pool has rotated its DNS records daily since October 8 to bring new addresses online [2].

What failed in each of this year's thefts from hardware wallet users, and the habit that would have covered it, is laid out in our comparison of 2026 hardware wallet attacks.

Sources

Labelled by type.

  1. SlowMist, SlowMist TI Alert: DarkSword Targets iPhone Crypto Users, October 24, 2026, 05:13 UTC. More than 1,500 phishing sites, data the kit steals, basic guidance. (Primary, the firm's alert on X)
  2. SlowMist, Threat Intelligence | Analysis of the DarkSword Trojan Backend and iOS Attack Chain, October 19, 2026 (summary on X). Exploitable version ranges, panel figures, targeted wallets, FomoPeek, recommendations. (Primary, the firm's technical report)
  3. Yu Xian (@evilcos), post on X, October 24, 2026. Poisoned installed apps and the data the kit steals. (Primary, statement by SlowMist's founder, in Chinese)
  4. 23pds (@im23pds), post on BlockBeats and post on the 1,500 sites, October 24, 2026. (Primary, statement by SlowMist's CISO, in Chinese)
  5. BlockBeats, Security Notice Regarding Abnormal Scripts Injected into BlockBeats Webpages, October 24, 2026. Page copied on October 22, outside script, cleanup. (Primary, official statement)
  6. GCSA, BlockBeats被投毒DarkSword攻击链,iPhone钱包面临失窃风险, October 24, 2026. Script loading on the "bitcoin" search page, guidance after a possible compromise. (Secondary, a security firm's analysis republished by Coinlive, in Chinese)
  7. Google Threat Intelligence Group, The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors, March 18, 2026. Original chain's version range, six vulnerabilities, patches. (Primary, report by the team that found it)
  8. Apple, Update iOS to protect your iPhone from web attacks, April 14, 2026. Which devices are protected, Lockdown Mode, Safe Browsing. (Primary, official note)
  9. Apple, About the security content of iOS 18.7.7 and iPadOS 18.7.7, March 24, 2026, expanded April 1. DarkSword fixes extended to more iOS 18 devices. (Primary, official note)
  10. Apple, About the security content of iOS 26.2 and iPadOS 26.2, December 12, 2025. Fixes for WebKit flaws CVE-2025-43529 and CVE-2025-14174. (Primary, official note)
  11. Apple, Apple security releases, accessed October 24, 2026. Release dates for iOS 27.0.1 and iOS 26.7.1. (Primary, official log)

More in Privacy and self-custody

See all 21 articles in Privacy and self-custody →

Last updated: October 24, 2026