Mazrael Warns SHIB Holders of DarkSword iOS Exploit on iOS 18.4–18.7

DarkSword Exploit Chain Reaches iPhones Through the Browser

The route in begins with a webpage. Google's Threat Intelligence team has documented an iOS exploit chain, tracked under the name “DarkSword,” that can take full control of an iPhone running iOS 18.4 through iOS 18.7 after nothing more than a visit to a booby-trapped website. A chain of that kind strings several vulnerabilities together, moving from browser contact to control of the operating system without prompting the user. The alert reached the Shiba Inu (SHIB) community on Thursday through Mazrael, a long-time member of the memecoin's holder base, who relayed it in a security reminder posted on X. One of the spyware tools used alongside DarkSword reportedly harvests cryptocurrency wallet data, device keychains, messages, photos and passwords from a compromised handset. Google's write-up places the documented use so far in targeted attacks across Saudi Arabia, Turkey, Malaysia and Ukraine, run by spyware vendors and suspected state hackers, while cautioning that other attackers may already be operating the same chain. The four countries are where use has been documented, not the limit of who can reach the tool. The alert matters most to holders who follow the Shiba Inu price and run a hot wallet from the same phones the chain targets, since a wallet application on a compromised handset is only as safe as the operating system beneath it. Mazrael's guidance is procedural: install iOS 26.3 or later, where the bugs are fixed; switch on Apple's Lockdown Mode where an update is not possible; ignore unknown links, above all those dressed up as crypto offers; and, where exposure is suspected, open a new wallet on a clean, updated device, move the funds to a fresh wallet address and never reuse a seed phrase that may have been read.

Binance Resumes Withdrawals and Flags Imitators

The security reminder lands while Shiba Inu (SHIB) withdrawals are moving again. Binance has re-enabled withdrawals in phases, with SHIB on the Ethereum network among the assets restored, a step covered in detail when Binance restored withdrawals for 55 tokens across two networks. The resumption followed a suspension, and the phased return is what created the window the exchange is now warning about. Its official announcement states that opportunistic scammers may pose as Binance through direct messages, emails, group chats and even small transfers carrying an attached note, offering to “speed up withdrawals,” arrange “priority processing,” help “claim compensation” or move assets into a “Binance vault.” None of those services exists: there is no paid place in the queue, no compensation desk reached by message and no vault product sold in a chat. The exchange adds that it will never contact a user first about an account or funds, and will never charge a fee to unlock a network or an asset. Users are told to treat any inbound contact about withdrawals, funds or compensation as suspect by default. The two warnings arrive from different directions and land on the same user base: one targets the device, the other targets the person holding it. Our earlier report recorded the market side, with Shiba Inu (SHIB) staying below $0.000005 as withdrawals came back online. Where a balance sits, between an exchange account and a self-held wallet, decides which warning applies to a given holder; our comparison of the types of crypto wallets sets out those options.

The load-bearing record here is Mazrael's post: it claims no SHIB holder has been hit, and the Google documentation behind it describes targeted use by spyware vendors and suspected state hackers rather than a campaign against retail wallets. What the record does establish is the point where a reader can still break the chain, and that point is open now. Self-custody in Web3 treats the phone as the perimeter, and DarkSword attacks exactly that perimeter, taking the device before any wallet application is opened. A handset patched to iOS 26.3 or later removes the chain's entry, and Apple's Lockdown Mode narrows the attack surface where an update is not possible. Nothing a holder does after a compromise recovers a seed phrase that was read, so the update is the step that matters. Market levels sit outside this story; they are tracked separately in our SHIB technical analysis.