Exodus and Phantom wallets were drained overnight from a single user. Despite keeping the seed phrase physically stored and never typing it on a phone, even CZ quoted the story 👀 From the victim’s post: · He woke up to a transaction notification on his phone. · His entire seed phrase was stored offline, so he was confused about how the attacker gained access. · He suspects his iPhone was compromised. · In replies, he admitted he avoids updates because they slow down his phone. CZ replied briefly: iOS must always be updated. He referenced DarkSword, an exploit kit targeting iOS 18.4 through 18.7. According to CertiK’s alert on November 6: · Simply visiting a malicious site in Safari is enough—no wallet connection or transaction signature required. · DarkSword combines six iOS vulnerabilities to bypass built-in protections. · It targets: keychain data, private keys, and seed phrases stored in wallet apps, as well as photos and notes containing seed phrases. · Affected wallets: MetaMask, Trust Wallet, Phantom, Exodus, Coinbase Wallet. This is a common misunderstanding: the seed phrase on paper is a backup. The wallet app on your phone still stores the keys on the device itself so you can transact. If your phone is compromised, the paper copy won’t help. What to check this morning: · Go to Settings > General > About. Check your iOS version and update to the latest. · If you can’t update yet, Trust Wallet recommends enabling Lockdown Mode. · Delete any screenshots or notes containing your seed phrase from your Photos and Notes apps. · For long-term storage, don’t keep funds in a hot wallet on a phone used to open random links. Note: While this case is linked to DarkSword, no forensic evidence has yet confirmed this conclusively.