Ukrainian Man Reported Theft of Nearly $70,000 from Trust Wallet Given iPhone Vulnerability

Published: October 21, 2026 – 09:50 UTC

An Instagram user reported the theft of more than $68,000 in USDT from his crypto wallet on October 15, 2026.
He linked the incident to the DarkSword exploit kit and an outdated iOS version.
In March, Google and other researchers had already reported DarkSword and Coruna being used to attack iPhones, including against Ukrainian users.

Ukrainian Instagram user Artur Romanchuk, under the alias aromnk, said that on October 15, 2026, he lost about $68,000 in USDT due to a compromised crypto wallet on his iPhone. In the video, he linked the incident to the DarkSword exploit kit and an outdated OS version, urging crypto holders to keep their devices updated and not store seed phrases in digital form.

The published screenshot of the transaction history shows a transfer of 68,327.41 USDT to a third-party address — about $68,234. The author also said that the private key was extracted from his wallet. At the same time, there is no independent confirmation that DarkSword was the cause of this incident.

“Don’t repeat my mistakes! Be responsible to yourself and your funds,” the author wrote in the post.

What Is Known about DarkSword and iPhone Risks

DarkSword is an iOS exploit kit that allows attackers to leverage OS vulnerabilities to take control of a device. In March 2026, Google Threat Intelligence Group reported that the tool was used in various campaigns, including against users in Ukraine.

According to Google, DarkSword targeted devices running iOS 18.4-18.7, and in some cases, simply visiting a compromised website was enough to get infected. The vulnerabilities used in this attack chain were later patched in iOS updates.

Google also described the Coruna exploit kit, designed for older iOS versions — from 13.0 to 17.2.1. It was linked to attacks on Ukrainian users and the cryptocurrency industry. Google’s report on Coruna mentions five attack chains and 23 exploits.

Moreover, Google, iVerify, and Lookout recorded a wave of DarkSword attacks on iPhone users in Ukraine, which was linked to Russia.

Recall that Ledger’s Donjon security team also identified a vulnerability in the firmware of Android smartphones powered by MediaTek processors.

In his video, Romanchuk claims that DarkSword can steal data from crypto wallets, notes, the gallery, messengers, and password vaults. Researchers also described the possibility of stealing cryptocurrency wallets, credentials, messages, and photos during a successful attack. However, the exact scope of the data accessed in the case of the video’s author has not been publicly established.

How to Reduce the Risk of Losing Crypto Assets

The author of the video urged users to:

Update iOS and apps, and install the latest versions of the operating system in which known vulnerabilities have been fixed
Not store seed phrases and private keys on the phone. Notes, screenshots, and photos can become a source of leakage if the device is compromised
Consider a hardware wallet for storing significant amounts of cryptocurrency
Open links carefully. Infection can occur via compromised web pages, even if the user does not install a separate app

If there are reasons to suspect the device has been compromised, a simple system update is not enough: it does not undo a possible key theft that may have already occurred. You should use a trusted, up-to-date device, create a new wallet with new keys, move your assets there, and also check and secure other accounts.

In the comments under the video, other users also reported cases of funds being lost from Trust Wallet. In particular, several commenters mentioned similar incidents in October, but these reports have not been independently confirmed and do not prove that the same attack tool was used in all cases.

Previously, we wrote that less than a month ago, SlowMist’s chief information security officer warned about a DarkSword attack on iPhone users’ crypto wallets.

Сообщение Ukrainian Man Reported Theft of Nearly $70,000 from Trust Wallet Given iPhone Vulnerability появились сначала на INCRYPTED.

Source: Incrypted