For long-term crypto holders, protecting a wallet also means protecting the device that can access its secrets. A PANews roundup published on November 6, 2026, at 17:36:56 (UTC+8) described reported iPhone-related wallet thefts and warnings about an iOS exploit toolkit called DarkSword. The central custody concern was exposure of private keys and recovery phrases—not a demonstrated flaw in wallet apps themselves.
Bitquery traces thefts from 430 wallets
According to the Bitquery research cited by PANews, a single group had stolen approximately $4.16 million from 430 wallets belonging to iPhone users since mid-October.
The investigation linked the activity through a common wallet used to supply transaction fees. It reported:
- At least 4.06 million USDT stolen from 365 wallets on TRON.
- More than $103,000 taken from another 65 wallets across eight chains, including Ethereum and BNB Chain.
Bitquery said that, after obtaining victims’ private keys, the attackers sent small amounts of TRX to the affected wallets to cover transaction fees, then drained their funds.
The report said there was no evidence that applications such as Trust Wallet themselves contained the vulnerability. Instead, it identified iPhone hacking tools such as DarkSword, which can steal recovery phrases, as the principal risk.
A separate DarkSword warning
The same roundup cited warnings from security researchers and crypto commentators about DarkSword. According to those warnings, the toolkit exploits low-level flaws in iOS 18: opening a compromised website in Safari can allow malicious code to run in the background, without connecting a wallet or signing a transaction.
The reported capabilities included stealing passwords, photos, files, private keys and wallet recovery phrases. PANews stated that at least 18 malicious websites had been identified, with reported losses reaching $5.57 million across more than 20 wallets.
These figures came from a separate item in the roundup. It did not establish how much, if any, overlap existed with Bitquery’s findings, so the two loss totals should not be added together.
Two source-supported security habits
Bitquery recommended keeping iOS updated and not storing recovery phrases in phone photos or notes. Changpeng Zhao also urged users to update iOS, particularly if they had not done so for some time, stressing that wallet software cannot update the operating system on a user’s behalf.
For holders, the distinction matters: a wallet application and the device hosting it are separate security boundaries. The reported absence of an app-specific vulnerability does not mean recovery phrases stored elsewhere on that device are protected.