Safari Zero-Day Exploit Targets iPhone Crypto Wallets

A security vulnerability affecting iPhones running iOS 13 through 26.5 is being used to target crypto assets. Blockchain security firm SlowMist confirmed on September 19 that the exploit allows attackers to silently extract private keys and mnemonic seed phrases from software wallets.

The attack is triggered when a user visits a malicious webpage in Safari. The exploit leverages a memory corruption flaw in WebKit and JavaScriptCore to gain an initial foothold. From there, the code bypasses Pointer Authentication Codes, escapes the browser sandbox, and achieves kernel-level access.

With kernel-level control, attackers can access the iOS Keychain where sensitive credentials are stored. SlowMist CISO 23pds issued an alert regarding the threat, which was later amplified by Ledger CTO Charles Guillemet on September 21. Guillemet advised users to update their devices immediately and avoid clicking suspicious links.

This incident follows a similar pattern observed in March 2026, when an exploit kit known as DarkSword targeted iPhones running iOS 18.x to harvest data from apps like Coinbase and MetaMask. While Apple has released patches for several vulnerabilities in the current chain through iOS 26.3, the delay between discovery and user updates remains a primary risk factor.

For self-custody users, the loss of a private key is permanent. Security researchers suggest that those who suspect their device has been compromised should regenerate their keys on a clean device and transfer their funds to a new wallet address. Hardware wallets remain unaffected by this specific Safari-based exploit as they keep keys air-gapped from the device's network connection.