iPhone Crypto Wallets Under Attack by State-Grade Malware

The security of iPhone users engaged in cryptocurrency trading is currently in jeopardy due to the emergence of the ‘Coruna exploit kit.’ This malicious software takes advantage of numerous iOS vulnerabilities to drain crypto wallets. Reports indicate that this new threat not only compromises devices but also indicates a worrying shift in the accessibility of advanced surveillance tools previously reserved for nation-states, now being weaponized for mass theft.

Key Takeaways

The Coruna exploit kit targets over 23 vulnerabilities in iOS to illegally access and drain crypto wallets.
This sophisticated attack method is being utilized by criminals, making tools once reserved for state surveillance available to the broader market.
Mobile crypto traders, especially those using self-custody wallets, are particularly at risk from this malware.
Users are advised to prioritize security and consider transferring crypto funds to cold wallets.

Crypto wallets and iPhones are under threat from the Coruna exploit kit and users should think twice before using web3 wallets on iOS

The Coruna Exploit and Its Threat to Crypto Wallets

The days of believing iPhones are impervious to threats are over for crypto traders. The Coruna exploit kit presents a serious challenge, harnessing 23 different vulnerabilities in iOS to bypass Apple's strong security and effectively rob users of their crypto assets.

A recent report from Google TAG highlights that this exploit does more than simply crash applications or display unnecessary ads. Instead, it works quietly in the background, searching for ways to steal BIP39 seed phrases, extract QR codes, and rob private keys from devices that haven’t been updated. By the time users realize their browser has been compromised, it’s usually too late.

This situation is critical. Previously, such advanced attacks were largely retained by intelligence agencies for high-profile surveillance. Coruna marks a significant shift, as tools for state-level surveillance have now been repurposed for widespread theft.

Adding to the gravity of the situation, a Chainalysis report indicated that the crypto theft market is estimated to be worth over $75 billion in 2025, with a significant portion attributed to wallet draining attacks.

Coruna exploit kit targets iOS vulnerabilities to drain crypto wallets.

Understanding How Coruna Exploits iOS Weaknesses

The Coruna exploit kit is designed to execute a highly efficient “1-click” attack when users visit compromised websites, often masquerading as gambling platforms or news sites.

This attack leverages vulnerabilities in WebKit to infiltrate devices and utilizes local privilege escalation to break out of the restricted environment of the browser.

After analyzing iOS versions between 13.0 and 17.2.1, it is evident that Coruna adopts multiple strategies to deploy a crypto wallet drainer aimed at stealing blockchain assets. It scans the file system for cryptocurrency-related information, checks the photo library for QR codes, and extracts mnemonic phrases from the Notes app.

Such automated attacks can lead to immediate and irretrievable loss of assets. Therefore, iPhone users who engage in crypto trading or store their digital assets on their device must exercise extreme caution.

State-Grade Malware Available to the Masses

Historically, exploit chains of this nature were highly controlled and used by groups like NSO for precise surveillance of significant individuals, including journalists and diplomats.

However, Coruna disrupts this norm by taking vulnerabilities weaponized through campaigns like Operation Triangulation and making them accessible to financially motivated cybercriminals.

The threshold for executing a sophisticated attack on wallets like MetaMask or draining Trust Wallet has now plummeted, allowing even those with minimal technical expertise to carry out these malicious actions.

This pattern of espionage tools leaking into the general criminal landscape is alarming. The individuals behind the Coruna exploit are not looking to uncover state secrets but are simply after financial gain.

This operation represents a new era of large-scale theft, with the iVerify security firm documenting the exploit impacting at least 42,000 devices, with total losses still uncalculated.

Target Profile: Who is at Risk and Why Mobile Crypto Traders Need to Stay Alert

Mobile traders who utilize self-custody wallets are prime targets. The malware often hides in platforms frequented by crypto users, including unregulated gambling sites, questionable token claim pages, and unofficial app stores.

Coruna specifically focuses on data directories associated with popular non-custodial wallets. It looks for the encrypted vaults of wallets like MetaMask, BitKeep (now Bitget Wallet), and Trust Wallet. If encryption is weak or if users have stored their passwords in vulnerable notes or keychains, their wallets can be drained.

Risk is heightened due to user behavior. Mobile traders often interact with decentralized applications (DApps) and complete transactions quickly, often overlooking essential security practices.

Coruna exploits this shortcut behavior. Instead of attempting to deceive users into signing fraudulent transactions, it simply steals their access keys while they browse.

To stay safe, users should proceed cautiously and consider moving cryptocurrencies to cold storage solutions, such as Ledger or Trezor.

Conclusion

As the threat of malware like Coruna continues to rise, it is crucial for crypto traders, especially on mobile, to maintain vigilance and secure their assets from potential attackers.