How Crypto Is Stolen From iPhones and Trust Wallet Through an iOS 18 Vulnerability

If you have not yet updated your iPhone to the latest version of iOS, the editorial team strongly recommends that you do so. On October 15, Maria Dorvey had $16,000 in crypto stolen from several different wallets on an iPhone 15 running iOS 18. 

Article updated on October 30, 2026. Added fund movement monitoring and other cases.

Monitoring This Collector Network

Over 18 days of monitoring (October 10-28), 5.57 million USDT passed through nine shared accumulators in the network. The collector network’s withdrawal channels in this case sent 4.40 million USDT to the accumulators. Another 1.17 million USDT came into the accumulators from addresses outside this collector network. As a result, $5.57 million then moved on through the accumulators.

• Accumulators are nine shared transit wallets where USDT collected by the network flowed until October 17.
• Collectors are wallets that are the first to receive crypto from the victim.

How It Happened

Morning of October 15, Maldives. Maria is lying on the beach, with her iPhone 15 running iOS 18 beside her, using mobile data and no Wi-Fi at all. Around noon, she Googles an interesting video and opens it in Safari. One unlucky tap on an ad, then a redirect to an unfamiliar domain flashes by. Nothing was downloaded, nothing was installed, and there was not a single permission prompt.

At 12:29:48, 16,428 USDT leaves her Tron wallet. Twelve seconds later, TRX follows, leaving exactly 0.04 in the account. The thief script left the same balance in half of the drained wallets. At the same time, wallets on the TON network are emptied. Three apps with three different seed phrases are drained at once, and Maria had never written down two of those phrases anywhere.

“Transaction signing” is enabled, but it is no longer her phone signing the transactions. It is someone else’s computer using her keys.

At 12:51, she gets out of the water and opens her wallet history. She sees a collector wallet that already holds funds from sixteen other wallets, $174,000 in total. At 13:50, the entire amount is converted into USDD, which Tether cannot freeze.

Then the phone becomes a “brick”: apps disappear and the bank app will not open. Maria buys a ticket home and sums it up: “porn with **** has never cost me 1 million before.” That evening, the collector takes another $10 from yet another stranger.

What Was It?

When visiting a site with a video featuring ****** through Safari on iOS 18, she most likely received an exploit similar to DarkSword: it works on iOS 18.4-18.7 and infects an iPhone by simply opening a page in Safari, with no downloads, additional clicks, or confirmations. In this case, it could have been an ad redirect from the site where she was watching a video featuring ******. Such an exploit obtains wallet data and seed phrases within minutes, and the attacker then signs transfers on their own device. This is why “Transaction signing” did not help: it only protects actions within the app on her phone.

Crypto Movement Scheme

More Cases

Maria’s case is not the only one. Here are several more incidents involving the same exploit.

Case No. 1

A post in the @mazaseo channel: three iPhone owners contacted the author after all their funds were withdrawn on the same day, from different wallets.

Case No. 2

On October 12, funds were withdrawn from a wallet on an iPhone whose iOS was nine updates behind. The seed phrase was stored only on paper, and there was one outgoing transaction. Post in the “Po Ushi v Gemble” channel.

Case No. 3

Blogger GrinBratukha reported that nearly 40,000 USDT was stolen from him as well.

Case No. 4

Today (October 19, 2026), a woman contacted us with the same problem.