Serious iOS vulnerability makes theft of crypto wallets possible

Security firm SlowMist has raised the alarm about a serious vulnerability in iOS that criminals are actively using to steal private keys and recovery phrases from crypto wallets. The attack works on all iPhones with iOS 13 through iOS 26.5 and requires no action from the user other than visiting a malicious web page. Users are urgently advised to update their device immediately.

In brief

• Criminals are exploiting a series of vulnerabilities in iOS to gain full control of a device and steal wallet data.
• The attack runs through Safari and affects iOS versions 13 through 26.5.
• SlowMist advises all iOS users to update their device as soon as possible.

How the attack works

The attack chain begins when a victim lands on a malicious page in Safari through social engineering or a compromised website. The attackers then exploit a memory leak in WebKit and JavaScriptCore, the parts of iOS that process web pages, to gain read and write access at the JavaScript level.

From that point, the attackers bypass Pointer Authentication Codes, a security mechanism from Apple, in order to execute their own code. They then break out of the secure WebContent environment and elevate their privileges to the highest level within the operating system. With those root privileges, they can then read and steal the Keychain and locally stored wallet data.

Active exploitation on all widely used iOS versions

23pds, the Chief Information Security Officer at SlowMist, warns that criminals are already actively deploying this attack chain. With a single click on a link, they can steal private keys and recovery phrases directly from the device without the user noticing.

The affected versions range from iOS 13 to iOS 26.5, although the exact upper limit has not yet been definitively confirmed. The fact that the attack works so broadly makes the threat especially serious for anyone who uses a crypto wallet on an iPhone. A similar pattern of targeted attacks via browser flaws was also seen earlier in the hack of OpenAI. SlowMist’s advice is unequivocal: update iOS immediately to the latest available version.