Shiba Inu community member flags DarkSword iOS exploit risk to crypto wallets
In brief
- Mazrael, a long-time Shiba Inu community member, posted an iPhone security reminder on X.
- DarkSword reportedly takes over iPhones running iOS 18.4 through 18.7 via booby-trapped websites.
- One linked spyware tool reportedly targets crypto wallet data, keychains, messages and passwords.
- iOS 26.3 and later fix the flaws, according to Mazrael.
What the warning says
Mazrael's post cites Google's findings. LeoDex News hasn't reviewed Google's report directly, so the details here come from the X post as reported by U.Today. This is a general iOS risk. It isn't a SHIB-specific bug, even though the warning surfaced inside the Shiba Inu community.
According to U.Today, one of the spyware tools tied to DarkSword goes after crypto wallet data, device keychains, messages, photos and passwords. Google said spyware vendors and suspected state hackers had used it in targeted attacks, per the report, and warned that other attackers may be using it too. Mazrael's post (again citing Google) put those attacks in Saudi Arabia, Turkey, Malaysia and Ukraine.
U.Today said the exploit raises concerns for crypto holders who use their phones to reach wallet services and other sensitive accounts.
What iPhone users are told to do
Mazrael urged iPhone users to install the latest iOS updates, saying the vulnerabilities were fixed in iOS 26.3 and later. Users who can't update were told to turn on Apple's Lockdown Mode and to avoid suspicious links (especially ones involving crypto).
"A safe wallet on an unsafe phone isn't safe. Don't panic, just update."
For anyone who thinks they've been compromised, the advice is blunt: create a new wallet on a clean, updated device, move the funds over, and never reuse a seed phrase that's been exposed. U.Today's report doesn't cite any confirmed wallet losses tied to DarkSword.
Binance flags a separate scam risk
U.Today also reported that Binance has resumed withdrawals in phases, with SHIB withdrawals on the Ethereum network enabled. Binance warned in a recent post that scammers may try to take advantage of that window. Impersonators may reach out through DMs, emails, group chats and even small transfers with messages attached, offering to speed up withdrawals or move assets into a "Binance vault," per the report.
Binance won't contact users first about their account or funds, sell spots in the withdrawal queue, or charge a fee to unlock a network or asset, U.Today said.
Frequently asked questions
Which iPhones are affected by the DarkSword exploit?
According to Mazrael's X post, which cited Google's Threat Intelligence team, DarkSword targets iPhones running iOS 18.4 through iOS 18.7. The post said it can take full control of a device when the user visits a booby-trapped website.
How can iPhone users protect their crypto wallets from DarkSword?
Mazrael urged users to install the latest iOS updates and said the flaws were fixed in iOS 26.3 and later. Users who can't update were told to turn on Apple's Lockdown Mode and avoid suspicious links, especially ones involving crypto.
What should I do if I think my phone was compromised?
The reminder said to create a new wallet on a clean, updated device and move funds into it. It also said an exposed seed phrase should never be reused.
