Researchers reported a vulnerability in certain iOS versions that allows attackers to access crypto wallets via Safari without user confirmation.

How the exploit operates

The exploit requires only that a user opens a malicious webpage in Safari on a vulnerable iPhone; no wallet connection or transaction approval is necessary.

According to the reports, the flaw enables remote actors to extract wallet data and initiate asset transfers without interacting with the device owner’s explicit signing actions.

Public response and remediation

Against the backdrop of warnings about the DarkSword chain, Changpeng Zhao (CZ) urged users to update iOS to a patched release as soon as possible.

Security notices indicate that vulnerabilities related to the DarkSword chain have already been fixed in recent system updates, and app-level updates alone are insufficient.

Recommendations for users

• Install the latest iOS update from Apple to ensure the system-level fix is applied.
• Avoid visiting untrusted websites in Safari and disable unnecessary browser extensions on mobile devices.
• Consider moving large holdings to offline storage until device integrity is confirmed.

Users and administrators are advised to prioritise system updates and follow vendor guidance to mitigate risks associated with in-browser cryptographic exploits.