CZ Warns iPhone Users to Update iOS as DarkSword Raises Wallet-Security Concerns

CZ’s warning puts device updates at the center of wallet security

Binance co-founder Changpeng Zhao, widely known as CZ, urged iPhone users to install the latest iOS updates in a November 6 post on X. He placed particular emphasis on people who have not updated their devices for some time. The message followed reports about DarkSword, an exploit said to use malicious websites opened in Safari to target information on iPhones. The immediate issue is the security of the device holding wallet data, not only the security of a wallet application.

CZ also highlighted a boundary that can be easy to overlook: updating a crypto wallet app does not update the phone’s operating system. His message framed self-custody as requiring users to take responsibility for device maintenance as well as for managing their wallet. That distinction matters in this reported scenario because the alleged route into a phone is a compromised website, rather than a flaw that necessarily requires action inside a wallet app.

The reported concern is that a person could expose sensitive information simply by visiting an infected site, without connecting a wallet, signing a transaction or granting an approval. A crypto user discussing the threat described wallet files and recovery phrases stored on the device as potential targets. Those details explain why the report has attracted attention among self-custody users: information that can help control a wallet may be at risk even when the user does not initiate a crypto transaction.

What researchers have reported about DarkSword

The claims about DarkSword are not limited to a possible route of entry. Threat researcher Officer’s Notes reported that approximately $5.57 million worth of cryptocurrency had already been stolen through the vulnerability. The account also alleged that more than 18 websites were involved in distributing malicious code. These figures are reports from the researcher, rather than independently established findings in the supplied material, so they describe the scale being claimed and should be read with that attribution in mind.

Officer’s Notes further reported that DarkSword was being offered for sale online for $30,000, with iOS 18.6.2 listed by the seller as the latest firmware it supported. The researcher also said they found placeholders for iOS 26 and 27. That observation may indicate preparation for possible future exploits, but placeholders alone do not establish that working attacks exist for those versions. The account presents them as a possible sign of planned development, not proof of current capability.

The researcher said Apple had already patched all six vulnerabilities used in the known exploit chain. That is an important qualification to the warnings: the reported chain is not described as unpatched across the board. However, Officer’s Notes said parts of an older version could still be reused, and reported finding an iteration with a function dedicated to the imToken wallet. The available account does not specify the conditions under which that code remains usable or identify every affected device.

Earlier iPhone incidents underline the exposure

The reports therefore point to two connected but distinct questions: whether a phone has installed fixes for the vulnerabilities in the known chain, and whether older wallet-focused code can still be repurposed. Apple’s patches address the vulnerabilities identified in that chain, according to the researcher, while the claim about reusable components concerns code from an earlier version. The source does not establish that every iPhone remains exposed, nor does it provide a complete list of devices or software states at risk.

For people who keep recovery phrases or wallet files on a phone, the alleged no-approval route changes the usual mental model of transaction security. A user might expect a wallet connection or signature prompt before assets can be put at risk, but the report describes sensitive data as a possible target after a visit to a compromised site. This does not mean every visit results in theft; it underscores that device and browsing security can matter alongside safeguards built into wallet software.

DarkSword is not the only iPhone security issue in the source linked to crypto concerns. A separate vulnerability in Apple’s CoreGraphics 2D rendering engine could allow malicious code to run when the device processed a specifically crafted file. Apple addressed that issue with releases identified in the report as iOS 26.7.1 and iPadOS 26.7.1 toward the end of September. The account does not connect that incident technically to DarkSword; it is relevant as another reported example of device-level exposure.

What is known—and what remains unresolved

Apple acknowledged that the CoreGraphics flaw may have been exploited in highly sophisticated attacks against specific people, according to the supplied account. SlowMist responded at the time by warning crypto users to update their devices and avoid suspicious links and downloads. That history provides context for CZ’s current emphasis on operating-system updates, but it does not show that the earlier flaw and DarkSword are the same exploit. The incidents are presented as separate security cases with a shared concern for sensitive information.

A further case involved the FomoPeek app. SlowMist and OKX security reportedly found malicious code in the application that could exploit iOS weaknesses and access sensitive information beyond what FomoPeek normally had permission to reach. The supplied report does not give details about the number of affected users, losses or the timing of any theft. Its relevance here is narrower: installed apps, like websites and operating-system flaws, were also described as a possible route to information outside their expected access.

Several details remain uncertain in the DarkSword account: the full scope of affected devices, how the reported thefts were verified, and whether the identified older code can operate against current software in practice. The report says the six vulnerabilities in the known chain have been patched, but does not resolve those broader questions. CZ’s recommendation is clear within that uncertainty—keep iOS updated—while the source offers no basis for concluding that every iPhone user is affected or that an update alone answers every wallet-security concern.

Source: CryptoPotato