# CertiK Warns DarkSword Can Expose Wallets on Unpatched iPhones

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/51543
Published: 2026-11-08T10:53:27.000Z
Updated: 2026-11-08T10:53:27.000Z
Section: Technology

> A malicious Safari page can trigger the exploit on iOS 18.4 through 18.7 without a wallet connection or transaction approval.

CertiK warned Nov. 6 that an updated iPhone exploit called DarkSword can expose crypto wallet credentials when a user opens a malicious Safari page, putting unpatched devices at risk.

A wallet connection, transaction approval or file download is not required. A malicious page can trigger the attack on devices running iOS 18.4 through 18.7.

DarkSword links six system-level vulnerabilities to get around iOS protections and install software that collects data. Targets include wallet private keys and recovery phrases, passwords stored in iPhone Keychain, photos and notes.

The alert names MetaMask, Trust Wallet, Phantom, Exodus and Coinbase Wallet among the mobile wallets at risk. CertiK urged affected users to install the latest iOS update and recommended Lockdown Mode for people facing targeted attacks. It also advised against storing recovery phrases in screenshots, notes or cloud services.

The exploit was documented earlier this year, and an October variant called P7 added two-way remote-control capability.