A Ukrainian says iPhone spyware took $68,000 from his wallet

A Ukrainian user says more than $68,000 in USDT left his Trust Wallet on 15 October, and he blames spyware on his iPhone running an outdated version of iOS. The account is his own. Nobody has independently confirmed what took the money.

What DarkSword actually is

The tool he names has a documented history, which is worth separating from his case. Google's Threat Intelligence Group described DarkSword in March: six vulnerabilities chained together against iPhones on iOS 18.4 through 18.7, delivered through malicious web content, with no file to download and no app to install.

“The victim does not need to download a file or install an app. Opening the wrong page is enough.”

— Google Threat Intelligence Group, Description of the DarkSword delivery method, March 2026

A newer piece of it was disclosed on 8 October by the security firm iVerify. The component, called P7, is post-compromise malware rather than a new way in: once the phone is taken, one function scans for installed wallet apps and another extracts data, and the implant asks an attacker-controlled server for instructions every 15 seconds. It also lifts the Apple Keychain, Notes and the photo library, which is where seed phrases usually sit when people keep them at all.

The date that matters

Here is the part that changes how this should be read. Apple patched the chain in iOS 18.7.7 on 24 March, with wider release on 1 April. The theft is dated 15 October, 205 days after the fix shipped. The exposure was not a zero-day on the day it mattered; it was an unpatched phone.

Why the attribution is loose

The attribution is also looser than the headline. The research names imToken as the wallet its extraction function targets, and documents no confirmed cryptocurrency thefts at all. A wallet scanner that finds Trust Wallet installed is not the same evidence as a tool that drained it, and the person who lost the money is the only source for the connection.

One question nobody is asking out loud. The money moved as USDT, which is freezable: Tether has frozen $4.9bn across its history, about half of it for US agencies. Whether a freeze was requested within the hours that matter is the difference between a report and a recovery, and the account does not say.

The practical lesson is older than the exploit. Update the phone, and keep the recovery phrase off every device that has a browser on it, because the malware reads notes and photographs before it touches a wallet. The same ending arrived by post last week when tampered hardware wallets mailed the seed phrase out instead.

Informational material, not investment advice. The loss is described by the person who suffered it, the link to a specific exploit kit has not been independently confirmed, and the figures below come from published security research.