SlowMist Warns New iOS Threat Could Expose Crypto Wallet Data

Highlights:

• SlowMist warned iPhone crypto users to update after researchers identified risks to wallet data and private keys.
• Researcher 23pds said advanced attacks could move from malicious webpages into deeper parts of the iPhone system.
• Apple released iOS 26.7 with security fixes, though it has not confirmed the full attack chain.

Crypto users on iPhones are being urged to update their devices after a security researcher warned that advanced attacks could expose private keys, recovery phrases and wallet data. On September 19, SlowMist partner and Web3 security researcher 23pds said on X that his team had analyzed the issue with OKX. Based on that analysis, he recommended upgrading to iOS 26.7 or a newer version. Apple released iOS 26.7 on September 14 with a large set of security fixes.

The warning is especially relevant for people who manage crypto wallets on iPhones. Private keys and mnemonic phrases, also known as seed or recovery phrases, can give full control over cryptocurrency stored in a wallet.

我上午拉团队和okx分析
其实这不是某个软件 '独有'
'水坑' 太多…很难知道哪一个软件或哪一个版本可能有问题 （水坑是啥后面我们专门文章解释）
🤣终极解决方案：升级到iOS 26.7及以上！ https://t.co/PSVW3OVvsd

— 23pds (山哥) (@im23pds) September 19, 2026

Researcher Warns of Multi-Step iPhone Attack

In an earlier post shared in the same thread, 23pds described a possible attack chain that starts when a user opens a malicious link or webpage. According to the researcher, attackers have developed methods that can target Safari and the WebKit browser engine. The reported attack can move from browser-level access to deeper parts of the iPhone operating system.

He described the possible progression as:

“Bypassing PAC to gain native call capabilities, escaping the WebContent sandbox, kernel privilege escalation to obtain root permissions.”

23pds claimed attackers could eventually gain access to data stored in Apple’s Keychain and cryptocurrency wallets. He also said malicious links could be used to target private keys and mnemonic phrases.

The researcher listed iOS versions from 13 through 26.5 as potentially affected, although he marked that range as pending. Apple has not independently confirmed that full range as vulnerable to the attack described in the post. In his September 19 update, 23pds said the problem did not appear to be limited to one particular wallet or application. He therefore advised users to update the operating system itself instead of relying only on individual app updates.

Apple Released iOS 26.7 With Security Fixes

Apple released iOS 26.7 and iPadOS 26.7 on September 14. Its security bulletin lists fixes across WebKit, system storage, Safari-related components and several areas involving access to sensitive user data. One WebKit vulnerability could allow maliciously crafted web content to cause memory corruption. Apple said it addressed the use-after-free issue with improved memory management.

However, Apple has not publicly stated that iOS 26.7 was released specifically to fix the attack chain described by 23pds. The latest warning also follows earlier concerns around DarkSword, an iOS exploit chain disclosed in March. Lookout Threat Labs said DarkSword targeted vulnerable iPhones through web-based exploits and could steal sensitive information, including cryptocurrency wallet data.

Earlier DarkSword research focused mainly on iOS 18.4 through iOS 18.6.2, while other security researchers reported exposure across parts of the iOS 18.4–18.7 range. Those vulnerabilities were patched through earlier Apple updates. The September warning therefore appears broader than the original DarkSword findings. For crypto users who keep wallets or other sensitive financial information on an iPhone, installing Apple’s latest available security update reduces exposure to known vulnerabilities.