GoPlus Security Flags $561,000 in iOS Wallet Thefts Hitting Trust Wallet Users

Trust Wallet Users Hit Hardest

iOS users who kept funds in self-managed crypto wallets lost roughly $561,000 across two weeks of intrusions, and the security team GoPlus Security traced the cluster to unpatched iPhones. The tally was published on Nov. 5 and drew on case files collected by the Security Alliance (SEAL), a volunteer coalition of on-chain investigators whose latest weekly statistics ran from Oct. 28 through Nov. 3. That single window added six new reports of iOS wallet compromise worth about $127,000 on its own. Most of the affected users held their assets in Trust Wallet, and the same weekly count picked up one Uniswap Wallet case as well. SEAL's report places the majority of victims in Russia, Ukraine and Kazakhstan. GoPlus's alert tied the wave to criminal campaigns aimed at older iOS builds: attackers exploit vulnerabilities those versions no longer receive patches for, harvest device data and permissions, then move the funds out on-chain. Nothing in the pattern requires a victim to sign a transaction or read out a recovery phrase. A hot wallet keeps its private keys on the phone itself, so an attacker who gains high-level access can drain it quietly in the background. That is why losses accumulated even among users who never visited a suspicious site, and why GoPlus urged anyone holding assets on an iPhone to update the system immediately and audit installed apps. Users who had installed unknown software were told to treat the device as compromised and relocate remaining assets, advice repeated across both weekly counts. The reports have now appeared in consecutive SEAL weekly tallies, and GoPlus compiled the two-week picture from those case files rather than from a single incident.

GoPlus Security's two-week wallet-theft warning on X

DarkSword and Coruna Kits

Behind the totals sits a specific toolkit. SEAL's weekly report cited scanning observations from Censys recorded in October, which showed exploit kits known as DarkSword and Coruna already aimed at wallet applications. Both chains can compromise older iOS builds in Safari or through malicious apps, and both go after the keys and recovery phrases mainstream wallets keep on the device. GoPlus stressed that the campaigns rely on unpatched systems, so a phone left inside the vulnerable version range can be emptied even if its owner never exports a recovery phrase or approves a transfer. The direction of travel was visible a week earlier: SEAL's previous report flagged a sharp rise in Trust Wallet iOS cases and suspected DarkSword was being delivered through malicious advertisements, which matches what the newest tally shows. The overlap matters because it dates the campaign: the surge in Trust Wallet reports began before the six cases recorded from Oct. 28 to Nov. 3, and the latest count is the second consecutive weekly report to carry the pattern. The guidance issued alongside the numbers was concrete. GoPlus told users to move to the latest iOS version to shorten the time a device spends inside a known exploit range, and to review installed apps for anything unknown or recently added, especially tools promoted on social media that require the phone to stay active for long stretches before a reward is paid. The instruction to rebuild a wallet on a clean device and move out remaining assets treats any key that touched a compromised phone as burned. Readers who want to judge such disclosures themselves can start with our guide to blockchain security audits. The cluster also lands after other security scares around the wallet this year, including critical PHP vulnerabilities the team said required no user action and warnings about a fake Trust Wallet site that circulated earlier.

The pattern SEAL and GoPlus described is a device compromise rather than a flaw in either wallet's code. Trust Wallet and Uniswap Wallet appear in the reports because they are widely installed on iPhones, while the intrusion mechanism runs through the operating system. For holders, the practical response is to shrink the time a device spends on an outdated iOS build, treat unfamiliar apps as hostile, and keep long-term holdings in a hardware wallet that never stores keys on an internet-connected phone. SEAL's newest count ran through Nov. 3 and GoPlus's warning followed two days later, so the gap between the last recorded theft window and the public alert is short enough that the campaign is still current.