A newly discovered iPhone exploit framework called “Coruna” has triggered serious warnings across the crypto and cybersecurity world. Researchers from Google Threat Intelligence Group (GTIG) revealed that the exploit can silently steal cryptocurrency wallet data — including seed phrases and private keys — simply when a vulnerable iPhone visits a malicious website.
This discovery highlights a growing danger: mobile devices are now becoming a direct attack point for crypto theft.
What Is the Coruna Exploit Kit?
Coruna is a sophisticated exploit framework built to break through Apple’s iOS security layers. According to researchers, the toolkit includes:
5 full exploit chains
23 different vulnerabilities
Remote access capabilities for compromised devices
Once an iPhone is infected, the malware can scan the device for sensitive financial data such as:
• Cryptocurrency wallet apps
• Seed phrases and private keys
• QR codes used for wallet recovery
• Notes, screenshots, or files containing financial credentials
This information can then be sent directly to attackers, allowing them to take complete control of a victim’s crypto wallet.
Which iPhones Are Vulnerable?
The exploit mainly targets devices running:
iOS 13
iOS 14
iOS 15
iOS 16
iOS 17 up to version 17.2.1
Older or unpatched devices are especially at risk.
Newer iOS versions have already fixed many of the vulnerabilities used by Coruna, which means keeping your device updated is critical.
Researchers say the attack is usually delivered through malicious or compromised websites, where the exploit can run automatically when a vulnerable device loads the page.
From Spyware to Crypto Theft
What makes Coruna particularly concerning is its origin.
Researchers believe the toolkit was initially used in targeted espionage operations, potentially linked to state-backed surveillance campaigns.
Over time, versions of the exploit began appearing in cybercriminal networks focused on financial theft, especially cryptocurrency.
This pattern has happened before — powerful cyber-weapons designed for intelligence operations eventually leak into underground criminal markets.
Why Crypto Users Are the Main Target
Security analysts discovered that Coruna contains modules specifically designed to locate cryptocurrency wallet data.
If attackers obtain a seed phrase, they can:
• Restore the wallet on another device
• Instantly transfer funds
• Permanently control the assets
Because blockchain transactions are irreversible, victims usually cannot recover stolen funds.
How to Protect Your iPhone and Crypto Wallet
Cybersecurity experts recommend the following precautions:
1️⃣ Update iOS immediately
Always run the latest version of iOS to patch known vulnerabilities.
2️⃣ Enable Lockdown Mode
Apple’s Lockdown Mode can block certain advanced exploits.
3️⃣ Avoid suspicious crypto websites
Never click unknown crypto links shared on social media or messages.
4️⃣ Never store seed phrases digitally
Avoid saving recovery phrases in notes, screenshots, or cloud storage.
5️⃣ Use a hardware wallet
Hardware wallets keep private keys offline and significantly reduce risk.
Researchers also noted that Coruna may disable itself when Lockdown Mode or private browsing protections are active, making these features especially valuable.
The Bigger Cybersecurity Warning
The discovery of Coruna highlights a dangerous trend in modern cybersecurity.
Tools originally built for government intelligence and surveillance are increasingly leaking into the hands of cybercriminal groups.
At the same time, as cryptocurrency adoption grows, attackers are developing more advanced ways to target wallets and seed phrases directly through smartphones.
For crypto users, the message is clear:
⚠️ Your device security is now just as important as your wallet security.
🔥 Viral Crypto & Cybersecurity Tags
#CryptoSecurity
#CryptoNews
#Bitcoin
#Ethereum
#SeedPhrase
#iPhoneSecurity
#CyberSecurity
#Web3Security
#CryptoSafety
#BlockchainSecurity
#CryptoAlert
#DigitalAssets
#StaySafeCrypto
