Security firm SlowMist reported on September 19 that an active full-chain exploit targets iPhones running iOS 13 through 26.5. The vulnerability allows attackers to gain kernel-level access by exploiting a memory corruption flaw in the WebKit engine through a malicious Safari webpage.
Once the attacker gains kernel access, they can extract private keys and seed phrases from the iOS Keychain. This bypasses security measures like Pointer Authentication Codes and the browser sandbox. Ledger CTO Charles Guillemet confirmed the warning on September 21, advising users to update their devices.
This incident follows the discovery of the DarkSword exploit kit in March 2026, which targeted Coinbase and MetaMask on iOS 18.x devices. While Apple has released patches for parts of the current exploit chain in iOS 26.3, the risk remains for users who have not updated their software.
Experts recommend that users who suspect their devices are compromised should regenerate their keys on a clean device and move their funds to new addresses. Hardware wallets are suggested as a safer alternative because they keep private keys isolated from internet-connected software.
