Trust Wallet Users Report Six-Figure Losses Tied to iOS Exploit Kits

A Trust Wallet user says 3,830 USDT vanished from his wallet without any transaction approval on his part. Iaroslav Dubovoi, who posts on X as @noirvox_studio, reported the loss on November 3 and shared a transaction hash (6e26ec6faf90f1c9f484e5f19d29a207da0c55918191c8dbf20625d9250ac25d) tied to the missing funds. On-chain records confirm the transfer moved. Dubovoi says he cannot determine how it was authorized, and Trust Wallet has not publicly responded.

Dubovoi said no warning appeared and no confirmation was requested before the funds left. He has used Trust Wallet for about five years with security measures in place, he wrote. He has not specified which blockchain network or device he was using, and nothing so far ties his case to any specific attack. Trust Wallet is a self-custody wallet, meaning private keys are generated and stored on the user's device — the company never holds them.

What did the October case involve?

Dubovoi's report follows a larger, separate loss. Artur Romanchuk, a Ukrainian user who posts on Instagram as "aromnk," said 68,327.41 USDT — about $68,234 — left his Trust Wallet on an iPhone on October 15, according to Ukrainian business outlet BZNS. He attributed the theft to the DarkSword iOS exploits running against an outdated version of iOS, and said his private key was extracted from the wallet.

"Do not repeat my mistakes! Be responsible for yourself and your funds," Romanchuk wrote. His account rests on his own video and a screenshot of his transaction history. No security firm has confirmed DarkSword caused the loss. Other users commenting under his video claimed they also lost funds from Trust Wallet in October; those claims remain unverified, and Trust Wallet has not publicly responded to his case either.

What is DarkSword?

DarkSword is an exploit chain that steals data, including crypto wallet information, from iPhones that have not been updated. Google Threat Intelligence Group, mobile security firm Lookout, and iVerify disclosed it in March. The researchers said it chains six vulnerabilities in iOS to escape the browser sandbox and gain elevated privileges, targeting iOS 18.4 through 18.7. Attacks begin when a user loads a compromised or malicious webpage in Safari, which then runs code hidden inside it.

"DarkSword is a complete exploit chain and infostealer written in JavaScript," Lookout said, adding that it can collect and exfiltrate targeted data "within seconds or at most minutes." Google documented a data-mining payload, GHOSTBLADE, used in some campaigns, and observed attacks on users in Ukraine, Saudi Arabia, Turkey, and Malaysia.

How industrial is the attack infrastructure?

Very. In October, internet-scanning firm Censys reported finding five exposed servers hosting an operational DarkSword and Coruna exploitation platform — Coruna being a related iOS exploit kit used alongside DarkSword. Censys described the operation as "commercial exploitation-as-a-service," complete with reseller accounts, commission rates, and device quotas, though it could not attribute the platform to a named actor.

The platform contained 18 modules targeting wallet apps, including:

• MetaMask
• Phantom
• Trust Wallet
• Coinbase
• Exodus
• imToken

The implant searches a device's Photos and Notes for BIP39 recovery phrases — the 12- or 24-word backups that can restore a wallet — and sends back only phrases that pass checksum validation. Censys recovered 11 victim recovery phrases from a single server capture. It cautioned that the 179 device "loot" directories it found should not be treated as a verified count of unique victims.

SlowMist published its own analysis of the DarkSword backend and iOS attack chain on October 19. The blockchain security firm said the exploit code became public in March, a version called DarkSword-PROV2 appeared on GitHub in July, and attack infrastructure was operational by late September. SlowMist called the toolkit a "highly automated complete attack pipeline" that steals keychain data and files, decrypts wallet data, and aggregates funds. The toolkit claims to support iOS 13 and above, but SlowMist's code analysis shows the effective exploit window concentrates on iOS 18.6 to 18.7.2 and iOS 26 to 26.1. "The publicly available vulnerability components have been weaponized," the firm said.

What can users actually do?

Apple has patched all six vulnerabilities. Fixes shipped across iOS 18.6, 18.7.2, and 18.7.3, plus iOS 26.1 through 26.3, with all flaws closed as of iOS 26.3. Apple said protections extend to older supported devices.

Researchers recommend updating iOS through Settings, General, Software Update, and avoiding links sent by unknown accounts on social media or messaging apps. They also advise against storing recovery phrases in Notes, Photos, screenshots, or cloud backups.

SlowMist said "merely opening a malicious page in the Safari browser could trigger vulnerabilities." It advises treating any device that has visited a suspicious page as compromised: create new wallets and transfer assets "using a clean device that has never accessed that page," then check every chain for unusual transactions and token approvals. Trust Wallet's own guidance for a suspected compromise is to create a new wallet on a clean, updated device, move remaining funds, and never reuse the exposed recovery phrase.

Has Trust Wallet had incidents before?

Its last confirmed security incident involved the browser extension, not the mobile app. In December 2025, a malicious version of its Chrome extension, v2.68, drained about $7 million from 2,596 wallet addresses, according to the company. Trust Wallet CEO Eowyn Chen said the malicious version "was NOT released through our internal manual process," and the company committed to reimbursing affected users.

What does this change for self-custody users? It shifts the security burden further onto device hygiene: with exploit kits scanning iPhones for seed phrases at scale, an unpatched OS is now as dangerous as a phished approval.