In this attack named DarkSword, the long-standing sense of security in self-custody was torn open with a visible breach. The attackers did not start with familiar phishing signatures or malicious authorization, but seized upon the underlying flaw in iOS 18, embedding the attack entry point within the Safari browser: as soon as users opened the infected website, even without connecting a wallet or signing any transaction, the malicious code could run silently in the background, targeting passwords, files, and photos, ultimately reaching the private keys and seed phrases of cryptocurrency wallets. According to multiple reports, the total amount of stolen cryptocurrency assets in this incident is approximately $5.57 million, affecting at least 20 wallet addresses or wallets, with some sources claiming at least 18 malicious websites were involved. It was not until November 6, 2026, that CZ publicly warned users to be vigilant against DarkSword zero-interaction attacks through Safari links and emphasized that no wallet software could update the operating system for them; only then did the crypto community collectively realize that many people thought they had complete control over self-custody, when in fact it was built on a system-level vulnerability they had never seriously examined.
Restoration of the DarkSword Zero-Interaction Attack Chain
In the restoration by security researchers, the first thing DarkSword did was package the flaw that originally existed only in the deep code of iOS 18 into a low-threshold exploit toolkit. The attacker only needed to attach the pre-set malicious payload of DarkSword to a website, and when users opened these infected pages with Safari, the underlying flaw would be triggered automatically, allowing the malicious code to execute quietly in the background. For the attacker, this was almost a "one-click deployment": select the target site, configure the script, and the rest is just waiting for traffic to come in.
The so-called "zero interaction" is fatal here. The entire process does not require users to download any new applications, does not require connecting any wallets, does not pop up signatures or permission confirmation windows, and does not even require deliberately clicking on a specific button on the page—simply accessing those malicious websites through Safari means that passwords, photos, and files stored on the iOS device have already begun being silently packaged and transmitted in the background. For users holding self-custody cryptocurrency wallets, the more dangerous aspect is that the private keys and seed phrases of the cryptocurrency wallets are also within the scope of being scanned and stolen, meaning that once hit by the DarkSword attack chain, what you lose is not just a certain account, but the entire digital identity and asset control. Several security researchers and KOLs issued warnings after detecting this exploitation method, as this almost invisible attack chain is the real blade that tears apart the illusion of self-custody security.
The Wallet Boundary of the Self-Custody Myth Being Burst
DarkSword has stabbed directly into the line many are unwilling to face: wallets are applications, but private keys exist within the system. For a long time, many users equated “having control over private keys” with “being safe,” as if simply not using a custodial platform would insulate them from risks beyond the chain. However, what has been penetrated this time is the underlying flaw of iOS 18, not the code of any specific wallet; the attack is accomplished through a Safari link, an infected webpage, which indicates that the true determinant of the life and death of your assets is often that layer of operating system you believe to be inherently safe.
On November 6, 2026, CZ reminded users to update iOS as soon as possible, especially those who had not updated the system for a long time, and pointed out this misunderstanding: no wallet software can update the operating system for users; self-custody means you must be responsible for both the seed phrases and the safety of the operating environment. The DarkSword incident clearly delineates the boundaries of protection between application layer and system layer—wallets can strive to uphold signing logic but cannot control the fact that the kernel has already been compromised. Once the system is breached, private keys and seed phrases will also be siphoned off in the background; this layer, neglected in the self-custody model, is a critical vulnerability many had not previously incorporated into their security assumptions.
On-Chain Victim Portrait: Targeted Addresses
Once the system layer is breached by DarkSword, private keys and seed phrases become pure "plaintext loot," followed by a series of on-chain victims who do not know each other. According to multiple reports, the estimated loss of cryptocurrency assets in this incident is about $5.57 million, with some sources stating that at least 20 wallet addresses or wallets were involved in this attack, and the same source also mentioned at least 18 malicious websites participating. This means that DarkSword is not precisely hunting a single wealthy wallet or target, but has completed a "batch harvest" of a group of dispersed self-custody iOS users over a longer period, with each address on-chain being just a solitary stolen node, combined reflecting the true scale of this event.
It is worth noting that currently available materials do not contain a complete list of victim addresses, nor have they disclosed the asset composition of these addresses, so we cannot confirm whether they share commonality in terms of position scale, types of holdings, or on-chain behaviors. Likewise, there is no evidence to suggest that any particular wallet application was targeted for specific attacks; all attributing responsibility to any specific wallet software currently lacks support from both on-chain and system-layer evidence. For researchers and users, this is just an emerging victim portrait: we know that the losses are dispersed across multiple addresses and wallets, but we still cannot see what user groups and risk habits these addresses connect back to. Whether we can complete this picture from more on-chain details will determine whether this attack is deemed an incidental event or a systematic security lesson.
Security Community Alerts and Platform Self-Rescue
While the scattered victim addresses were pieced together to form a vague victim map, information began to overflow along another line. On November 6, 2026, CZ, in a rare move, specifically named iOS in public channels, reminding users to "update the system as soon as possible, especially those devices that have not been updated for a long time," and emphasized that DarkSword could complete the attack just with a seemingly ordinary Safari link, which is a typical zero-interaction scenario. The technical warning of "iOS 18 underlying flaw + Safari entry" that originally circulated only within the security research circle was translated by this alert into a warning that ordinary users could understand: update the system, and don’t click random links.
Following this signal, several security researchers and KOLs quickly amplified the same theme: DarkSword is leveraging the underlying flaw in iOS 18, posing a real threat to iOS users with self-custody wallets. Mainstream platforms and communities simultaneously forwarded related alerts, simplifying protection suggestions into a few operational-level "minimum action guidelines"—quickly install the system update, temporarily avoid clicking unknown Safari links, and continuously monitor the follow-up prompts from security alert accounts. In contrast to the speed of information dissemination, public information still lacks any details regarding the identity of the attackers, specific malicious website domain names, or official technical announcements from Apple; the entire risk identification primarily relies on whether this third-party surveillance and trust-based alert network can cover enough end users.
Lessons to Be Learned Before the Next Round of Attacks
This DarkSword incident has laid the textbook open; what can be done immediately are actually very "boring" foundational actions: first, quickly upgrade all iOS devices that carry self-custody wallets to the latest available version, and do not bring the habit of "not updating the system for a long time" into the scene with asset keys; second, physically layer the usage of devices—one phone dedicated to a small amount of frequently used wallets and common apps, and another (or a tablet) exclusively for high-value wallets and core seed phrases, avoiding web browsing as much as possible, especially before the official patch for the iOS 18 and Safari zero-interaction exploit has been fully implemented; third, suppress the impulse to "click on links when you see them" or "open any website," even if it's a Safari link forwarded by acquaintances; you should assume there might be toolkits lurking behind it like DarkSword, capable of quietly siphoning off passwords, photos, files, and crypto assets. More importantly, the deeper understanding is: self-custody is just a choice of "asset holding method," addressing the question of who controls the private keys. Yet this $5.57 million loss proves that if the device carrying the private keys is itself insecure, this layer of protection in "self-custody" will be cut through—just as CZ reminded, no wallet software can update your operating system; you must be responsible for both the "asset holding method" and the "device security status." Looking ahead, there are three variables that need to be monitored continuously: whether a more hidden variant of DarkSword emerges, the pace at which Apple patches the underlying flaws of iOS 18 and the Safari zero-interaction attack surface, and whether this incident can truly change the update habits and daily operational disciplines of self-custody users. The intersection of these three will fundamentally determine whether similar attacks can easily replicate the same tragedy across more than twenty wallet addresses again.
Join our community, let’s discuss and grow stronger together!
AiCoin exclusive Hyperliquid benefit: https://app.hyperliquid.xyz/join/AICOIN88
AiCoin exclusive Aster benefit: https://www.asterdex.com/zh-CN/referral/9C50e2
On-chain Telegram community: https://t.me/AiCoinWhaleData
On-chain community: https://www.aicoin.com/link/chat?cid=N6OVMor5g
AiCoin on-chain Twitter: https://x.com/aicoinwhaledata
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。
