Hackers have figured out how to steal cryptocurrency through Safari without using any viruses

Researchers from the Google Threat Intelligence Group, Lookout, and iVerify have discovered the DarkSword exploit—a set of tools that leverages a chain of six iOS vulnerabilities, including those in Safari and the system software. This allows attackers to execute malicious code directly through the browser without forcing the victim to download any files or request any permissions.

One of the documented cases involved an iPhone 15 owner who was vacationing in the Maldives. The woman was watching a video on an adult website and accidentally clicked on an ad banner, after which Safari automatically opened a third-party link. Within just a few minutes, a total of $ 16,428—assets on the Tron and TON networks—disappeared from her three crypto wallets.

Separately, researchers recorded the transfer of 5.57 million USDT through nine transit crypto wallets linked to the same infrastructure. However, this amount cannot be considered the confirmed total stolen in a single attack, as some of the funds came from other sources.

DarkSword allows attackers to access passwords, messages, photos, and files on a smartphone. The malicious modules were found to include a feature for searching for seed phrases used to recover crypto wallets among photos and notes. Users of popular apps such as Trust Wallet, MetaMask, Phantom, and others are at risk.

According to Google, DarkSword was used by various hacker groups in attacks against users in Ukraine, Turkey, Saudi Arabia, and Malaysia. Experts reported the activity of this tool in March 2026.

The main solution is to update iOS to the latest available version. Apple has already released patches for all six vulnerabilities exploited by DarkSword and addressed them before the release of iOS 26.3. Experts also advise against clicking on suspicious advertising links, storing seed phrases in photos or notes, and using the same device for storing large sums of money and everyday web browsing.

If you suspect your smartphone has already been compromised, you should create a new wallet on a clean, updated device and transfer your funds there. The old seed phrase should no longer be used after that.