A sophisticated iOS exploit chain is putting cryptocurrency users on alert after security researchers demonstrated how a malicious webpage opened in Safari can be used as the starting point for a full device compromise and potentially expose sensitive wallet data.
The attack chain, known as DarkSword, was publicly documented in March 2026 by Google Threat Intelligence, alongside research from iVerify and Lookout. Researchers found that attackers could chain multiple vulnerabilities in iOS, beginning inside Safari’s JavaScript engine and eventually reaching the operating system’s kernel.
More recently, security researchers linked a related exploit capability to versions of the iOS application FomoPeek, raising fresh concerns among cryptocurrency users.
The attack can start with a Safari link
The most concerning aspect of the attack is its delivery mechanism.
According to research from the Cloud Security Alliance, an attacker can direct a victim to a compromised or malicious website in Safari. JavaScript loaded by the page can then fingerprint the device and attempt to exploit vulnerabilities in WebKit and other iOS components.
The DarkSword chain combined vulnerabilities affecting JavaScriptCore, the GPU rendering stack, Apple’s dynamic linker and the iOS kernel.
Researchers documented six vulnerabilities associated with the chain, including CVE-2025-31277, CVE-2025-43529, CVE-2025-14174, CVE-2026-20700, CVE-2025-43510 and CVE-2025-43520.
The vulnerabilities were subsequently patched across different iOS releases.
Google Threat Intelligence’s DarkSword research
From Safari to the iOS kernel
The exploit does not simply compromise a webpage.
Researchers describe a multi-stage chain in which an initial JavaScriptCore vulnerability can provide code execution inside Safari’s WebContent process. Another vulnerability can then be used to escape the browser sandbox, followed by techniques designed to bypass iOS protections and obtain kernel-level privileges.
The Cloud Security Alliance’s technical analysis describes the chain as moving from JavaScriptCore to the GPU process, then through Apple’s security protections and ultimately into the kernel.
That level of access is significant because the kernel sits beneath normal application security boundaries.
Once an attacker has achieved this level of compromise, sensitive information stored on the device can potentially become accessible, including data associated with cryptocurrency wallets.
Cloud Security Alliance DarkSword technical analysis
Why crypto users are particularly exposed
The danger for cryptocurrency users depends heavily on where private keys and seed phrases are stored.
A software wallet running on a compromised iPhone may store sensitive wallet information within application storage or Apple’s protected storage mechanisms. A sufficiently privileged exploit can potentially access this information.
This is different from a hardware wallet where the private key is generated and retained inside a dedicated secure device and is not exported to the iPhone.
In that scenario, compromising the phone does not automatically reveal the hardware wallet’s private key.
The distinction matters because the attack is not equivalent to saying that every crypto wallet on an iPhone is automatically compromised.
FomoPeek brings the threat closer to crypto
The issue gained renewed attention in September after researchers examined versions 1.1 and 1.2 of the FomoPeek iOS application.
According to reporting based on security research, those versions contained components identified as apptrace and libapptracecore. Researchers linked the components to an exploit framework capable of targeting iOS devices.
The application’s version history is particularly notable. Reports indicate that version 1.1 appeared around September 9 with the suspicious framework, version 1.2 retained it, while version 1.3 released around September 17 removed the framework.
Security researchers subsequently warned that the exploit capability could be used to compromise crypto wallets.
Crypto.news report on the FomoPeek investigation
Crypto theft has reportedly followed
The incident is not purely theoretical.
Security researchers reported receiving accounts of cryptocurrency theft associated with affected users. Reports have described assets moving across networks including Ethereum, BNB Chain, Polygon, Arbitrum and Base.
One account cited in Binance Square described a user losing approximately $1,000 following the FomoPeek incident. That particular account is an individual report rather than an independently verified total-loss figure, so it should not be interpreted as the overall financial impact of the campaign.
The broader evidence, however, shows why security researchers are treating the incident seriously: the underlying exploit capability has been demonstrated, and cryptocurrency users have reported losses.
Apple has already patched the DarkSword vulnerabilities
The original DarkSword vulnerabilities are no longer unpatched zero-days.
Apple released fixes across multiple iOS versions. According to the Cloud Security Alliance’s analysis, the relevant patches included fixes in iOS 18.6, 18.7.2, 18.7.3 and iOS 26.1 through 26.3, depending on the vulnerability.
Apple’s security documentation also records fixes for WebKit and other components in subsequent iOS releases.
The important takeaway is straightforward: running an outdated version of iOS leaves users exposed to vulnerabilities that have already been addressed by Apple.
What iPhone crypto users should do
Users who hold cryptocurrency on an iPhone should take several precautions.
1. Update iOS
Install the latest security update available for your device. Security patches are the first line of defense against known WebKit and iOS vulnerabilities.
2. Treat unexpected links as hostile
A malicious Safari page can potentially be enough to trigger an exploit chain on a vulnerable device. Users should avoid opening unsolicited links from unknown accounts, especially links related to crypto giveaways, airdrops, wallet verification or urgent account warnings.
3. Check whether FomoPeek was installed
Users who installed affected versions of FomoPeek should treat the device as potentially compromised and investigate their wallet exposure.
4. Move assets if compromise is suspected
If a software wallet’s private key or seed phrase may have been exposed, simply deleting the application is not enough. Affected users should create a new wallet using a clean environment and move remaining assets to the new wallet.
5. Keep long-term holdings off the phone
Hardware wallets provide an additional security boundary because properly generated private keys can remain inside the hardware device rather than being stored on the phone.
The bigger lesson for Web3
The incident highlights a security problem that extends beyond Apple.
Crypto users often think about security in terms of wallet applications, seed phrases and phishing websites. But the security of a wallet ultimately depends on the security of the device holding or accessing its keys.
A sophisticated browser exploit can attack the layer underneath the wallet.
That changes the threat model.
For a normal internet user, a malicious Safari link may look like a phishing problem. For a crypto user with private keys stored on the same device, a successful browser-to-kernel exploit can become an asset-security problem.
The DarkSword research therefore serves as a reminder that mobile operating-system security is part of crypto security.
Keeping iOS updated, minimizing sensitive key material on internet-connected devices and using dedicated signing hardware for significant holdings can reduce the consequences of a device compromise.
The exploit chain documented by researchers is technically sophisticated, but the defensive message is much simpler: patch the device, be cautious with links, and do not assume that a secure wallet application can compensate for a compromised operating system.
