The phone beside your hardware wallet may know more about your Bitcoin life than the wallet does. It holds email, messages, photographs, browser sessions, contacts, location history, and account recovery channels. Socket disclosed an attack chain this week that could collect it from an unpatched iPhone after its owner loaded a compromised web page. The victim did not need to install an app or approve a profile. A web page had breached the boundary around self custody.
A streaming site became the delivery system
Socket found 13 malicious Composer themes published across five vendor identities on Packagist. Operators of Vietnamese movie and comic sites installed the themes, which then injected hostile JavaScript into pages served to visitors. The site owners were victims too, but their visitors absorbed the damage.
The loader checked the visitor's platform and referral path. On a vulnerable iPhone, it loaded a staged exploit chain inside a hidden frame. That chain attacked WebKit, escaped the browser sandbox, reached the kernel, and installed spyware. Socket found code and device offsets aimed at iOS 18.4 through 18.6.x on models from the iPhone XS through the iPhone 16 family. The operators redeployed the chain on August 12 and rotated the loader again on August 17. They were still maintaining the system.
Other crews used the same techniques. Google Threat Intelligence Group documented separate DarkSword campaigns that used the same two WebKit vulnerabilities against targets in Saudi Arabia, Turkey, Malaysia, and Ukraine. Socket saw a similar staging pattern, though the kernel exploit differed. Exploit components can spread between crews even when operators and payloads differ.
Apple's advisory for iOS 18.7.3 confirms that malicious web content could trigger arbitrary code execution through one of those WebKit flaws. Apple also says the issue may have been used in an extremely sophisticated attack against specific individuals. Socket reports that the known stages fail against iOS 18.7.3 and current iOS 26 releases. The patch protects only phones that install it.
The payload wanted the life around the wallet
The final spyware collected keychain databases, Wi-Fi passwords, messages, contacts, photographs, browser cookies, call and location history, notes, calendars, health information, and account databases. The August version also searched the iOS keychain for seed or mnemonic material linked to seven mobile wallet apps. Every named app supported assets besides Bitcoin (a useful limit on what this report proves). Socket therefore did not present evidence of a campaign built specifically to steal bitcoin.
Bitcoiners still face the surrounding risk. A hardware signer keeps private keys off the phone. It leaves the owner's email, travel pattern, exchange session, address book, and counterparty conversations exposed to the phone. A stolen browser cookie may expose an account without revealing its password. A copied contact list can identify family members or business partners for impersonation. Photographs and notes become catastrophic if the owner captured seed words, backup codes, wallet descriptors, or inheritance instructions on the device.
Attackers do not need the master key to seize recovery channels, map relationships, drain custodial balances, attack a Lightning service, or build a physical threat profile. Cold storage still works, while the phone betrays everything arranged around it.
The movie-night Bitcoin trap
Maya secures her savings with a hardware wallet and has never typed the seed into her iPhone. She still uses that phone for email, a password manager, exchange access, family messages, and photographs from Bitcoin meetups. One evening she visits a free streaming site whose operator unknowingly installed a poisoned theme.
The exploit cannot extract the seed from Maya's signer because the phone never had it. It can collect sessions and account data that expose her trading accounts and contacts. Location history reveals when she travels. An old photograph containing a backup code or home address adds another piece. Her funds in cold storage may survive because the phone never held the seed. Her identity and recovery perimeter may already be compromised.
Any phone that authenticates accounts sits inside the security boundary. So does one that stores private conversations or photographs of backups. A missing wallet icon proves nothing.
Build a boundary before the next page load
Do this hardening run today.
1. Install the latest iOS release now. Open Settings, General, Software Update, then install every available update. Apple's current update instructions show how to enable automatic downloads and overnight installation. The known exploit chain targeted older versions. Delay gives it an opening.
2. Separate casual browsing from custody access. Keep pirate streams, gambling pages, unfamiliar link aggregators, and other risky browsing off the phone controlling sensitive email, exchange recovery, or Bitcoin business accounts. A secondary device is easier to replace than an identity perimeter.
3. Keep seed material off every networked phone. Never photograph seed words, paste them into Notes, send them through a messenger, or store them in a mobile password manager. Use the wallet's approved offline backup method. If a phone can search it, sync it, preview it, or back it up, malware may be able to collect it.
4. Reduce what one phone can recover. Prefer hardware security keys where supported. Keep recovery codes offline, and remove obsolete email or phone reset paths. One captured device should not unlock the chain.
5. Review mobile wallet exposure honestly. List every wallet, exchange, Lightning, password manager, and authenticator app on the phone. For each one, identify whether the device holds a private key, an active session, a recovery secret, or only public information. That inventory tells you what to watch and which credentials to rotate. If keys were exposed, it also tells you which funds must move.
6. Use Lockdown Mode when your threat model warrants it. Apple's Lockdown Mode limits complex web technologies and other attack surfaces for people facing sophisticated targeting. Lockdown Mode reduces convenience, and the phone still needs patches. Journalists, activists, executives, public Bitcoin figures, and people facing a specific adversary should evaluate that trade. Obscurity is a poor security control.
If the phone may already be compromised
An update closes the known holes. It cannot tell you whether spyware arrived before the patch. Stop using the suspect device for sensitive accounts and put it offline. From a device you know is clean, change the credentials for your primary email and password manager. Revoke sessions and rotate recovery codes. Then review account activity. Do not prepare a rescue transaction or reveal a backup on the suspect phone.
The custody response depends on what the device held. If seed words or a private key ever appeared on it, treat that wallet as exposed and migrate funds to a newly generated wallet through clean hardware and verified addresses. If the seed stayed inside a hardware signer, avoid a rushed sweep based only on the phone risk. Protect the signer and rebuild the account perimeter. Assess separately whether the compromised phone could alter transactions, expose wallet metadata, or reach a connected node.
A confirmed advanced spyware infection warrants expert incident response and a clean device rebuild. Preserve evidence first when legal, employment, or personal safety concerns make attribution important. Restoring every app and backup without review can recreate the exposure. A fresh home screen can hide old exposure. Recovery must remove the uncertainty.
Final thoughts
This campaign turned someone else's poisoned website into an attack on the most personal computer its visitors owned. Bitcoin self custody protects monetary authority, but it cannot stop a phone from leaking identity, account access, and recovery data. Patch quickly, then keep risky browsing away from sensitive access and every seed beyond the reach of a networked screen. Your custody threat model includes each coordinator and authenticator, plus any device that controls account recovery. Your seed can stay offline while your life leaks online.
