Cryptocurrency Wallet Owners Warned About DarkSword Threat for iPhone

Community member of Shiba Inu, Mazrael, on November 5 reminded cryptocurrency wallet owners about the threat of DarkSword – a set of vulnerabilities capable of providing attackers with extended access to iPhones. The threat was detailed back in March 2026, so it is not a newly discovered hack.

DarkSword uses a chain of 6 vulnerabilities affecting certain versions of iOS 18.4–18.7. In a successful attack, visiting a specially crafted web page can lead to device compromise without additional user actions. Subsequently, attackers can install programs to collect confidential data.

One of the detected variants of the malware is designed to obtain information from cryptocurrency wallets, system password storage, correspondence, and personal files. Photos and account data may also be at risk. However, there is no confirmed information about mass theft of SHIB using DarkSword.

Previously, cases of using this complex were recorded in several targeted campaigns involving developers of commercial spyware and groups presumably associated with state structures. The exact circle of users who may have been affected is not established.

All known vulnerabilities in the chain were fixed by the release of iOS 26.3, and for some devices, fixes appeared in other supported versions of the system. If it is impossible to install a suitable update, additional protection can be provided by Lockdown Mode, which restricts potentially dangerous device functions.

If there are grounds to believe that wallet data or recovery phrases have become accessible to outsiders, a safe option is to create a new wallet on a known clean and updated device. Compromised recovery phrases should not be reused.

Binance warned about withdrawal scams

A separate risk is associated with the phased restoration of cryptocurrency withdrawals on Binance. From November 3, the exchange began returning this function for additional assets, including SHIB on the Ethereum network.

The company warned about scammers who may impersonate exchange employees in personal messages, emails, and group chats. Among the pretexts used are accelerating withdrawals, priority processing of applications, and assistance with obtaining compensation.

Binance states that it does not offer paid queue spots for withdrawals, does not require transferring assets to special storage, and does not request recovery phrases. These fraudulent schemes are not related to DarkSword but also create a risk of losing access to digital assets.