'Visit Website and Lose Your Crypto': Ledger Exec Issues Warning About Safari Attack

Ledger Chief Technology Officer Charles Guillemet has warned cryptocurrency holders about a sophisticated iPhone attack that can compromise a victim's device via a malicious page in the Safari browser.

The warning pertains to DarkSword, an iOS exploit chain that is being used in real-world attacks.

The malware can break through layers of Apple's security protections before gaining deep access to an iPhone.

"In plaintext, you visit a website and lose your crypto," Guillemet wrote on X.

He urged users who keep cryptocurrency seed phrases or other sensitive wallet information on an iPhone to reconsider that setup, recommending a hardware wallet and, crucially, updating iOS.

Google Threat Intelligence Group disclosed DarkSword in March. Multiple threat actors have exploited the vulnerability since at least November 2025.

Researchers identified campaigns targeting users in Saudi Arabia, Turkey, Malaysia, and Ukraine.

The iOS exploit chain can steal sensitive information, including credentials and cryptocurrency wallet data, in a very quick manner.

How the attack works

A normal website opened in Safari does not have any meaningful access to the rest of an iPhone. Web content is usually isolated within Apple's browser sandbox.