DarkSword, an iOS exploit toolkit, is reportedly exploiting an underlying flaw in iOS 18 to run malicious code in the background after users visit infected websites through Safari. The attack does not require users to connect a wallet or approve a signature, and can expose passwords, photos, files, private keys and seed phrases. At least 18 malicious websites have been identified, with losses reaching $5.57 million across more than 20 wallets, according to security researchers and crypto industry influencers monitored by Odaily Planet Daily. Changpeng Zhao urged users, especially those who have not updated their devices for a long time, to install the latest iOS version. He also said wallet software cannot update an operating system, meaning self-custody (personally controlling crypto assets) leaves users responsible for device security.