iPhone Crypto Wallets Under Attack from State-Grade Malware

The period of assumed iPhone invincibility is over for cellular crypto merchants. A complicated new risk, the ‘Coruna exploit equipment’, is actively leveraging 23 disparate iOS vulnerabilities to bypass Apple’s top-notch safety and drain crypto wallets.

According to a brand new Google TAG report, the equipment doesn’t simply crash apps or serve adverts. It silently scans for BIP39 seed phrase theft, extracts QR codes, and siphons personal keys from unpatched units. The funds are gone earlier than the person realizes the browser has been compromised.

That issues. For years, superior exploit chains had been the unique area of nation-state intelligence businesses. Coruna marks a terrifying regime change: state-grade surveillance instruments have been repackaged for mass-market retail theft.

This iPhone crypto pockets warning comes as Chainalysis reported in 2025 that the crypto theft market is valued at over $75Bn, with pockets drainers accounting for a considerable amount of that determine.

How Coruna Exploits 23 iOS Vulnerabilities to Drain Crypto Wallets

The Coruna exploit equipment is a extremely environment friendly “1-click” assault that prompts when a person visits a compromised web site, usually posing as a playing or information platform.

It targets vulnerabilities in InternetKit to breach the gadget, then makes use of native privilege escalation exploits to flee the browser’s sandbox.

Analyzing iOS variations 13.0 to 17.2.1, Coruna employs a number of entry factors to ship a crypto wallets drainer designed to steal blockchain belongings.

It scans the file system for cryptocurrency-related strings, checks the picture library for QR codes, and extracts mnemonic phrases from the Notes app.

This automated exploitation can lead to instant and irreversible theft of belongings, and any iPhone person who makes use of their gadget for crypto buying and selling and asset storing wants to remain vigilant.

DISCOVER: Next Crypto to Explode in 2026

State-Grade Malware Goes Mass Market

Previously, exploit chains of this complexity had been hoarded by entities like NSO Group for focused surveillance of high-value targets—dissidents, journalists, or diplomats.

Coruna flips the script. It takes vulnerabilities weaponized in campaigns like Operation Triangulation, a suspected state-sponsored assault, and palms them to financially motivated legal teams.

The barrier to entry for executing a classy MetaMask hack or draining a Trust Wallet has collapsed, and even probably the most inexperienced tech heads can now carry it out.

This follows a disturbing sample whereby instruments developed for espionage inevitably leak into the broader cybercriminal ecosystem. The attackers behind Coruna should not in search of state secrets and techniques. They are in search of liquidity.

This is industrial-scale theft. The iVerify security firm documented the exploit affecting no less than 42,000 units, with whole losses not but introduced.

Who Is Being Targeted and Why Mobile Crypto Traders Are Especially Exposed

If you commerce on cellular and maintain self-custody wallets, you’re the goal profile. The assault vectors are sometimes embedded in websites that crypto customers frequent: unregulated playing interfaces, doubtful token declare pages, and third-party app shops.

The malware explicitly targets information directories related to main non-custodial wallets. It appears to be like for the encrypted vaults of MetaMask, BitKeep (now Bitget Wallet), and Trust Wallet. If the encryption is weak, or if the person has saved the password in a compromised keychain or be aware, the pockets is drained.

The danger is compounded by person habits. Mobile merchants often work together with DApps and signal transactions on the go, usually prioritizing pace over safety hygiene.

Coruna exploits this complacency. It doesn’t have to trick you into signing a nasty transaction; it merely steals the keys to the fortress when you browse.

For now, proceed with warning and contemplate transferring your crypto funds to chilly pockets storage, resembling a Ledger or Trezor.

EXPLORE: Best Crypto Presales to Buy in 2026

The put up iPhone Crypto Wallets Under Attack from State-Grade Malware appeared first on Cryptonews.