Two reports published on November 6 described different figures for iPhone-related crypto losses: The Defiant said Bitquery traced at least $4.06 million in USDT through a TRON theft network, while Incrypted reported $5.57 million in crypto losses attributed to DarkSword among iOS 18 wallet users. The figures do not make up a combined DarkSword total.
Keep the figures separate: one is a USDT trace on TRON; the other is a broader crypto-loss claim among iOS 18 wallet users.
What the two figures cover
The $4.06 million figure refers to USDT traced through a TRON theft network, according to The Defiant’s report, which named Bitquery as the tracing source. Incrypted’s $5.57 million figure covers crypto losses attributed to DarkSword among iOS 18 wallet users. The two reports describe different scopes.
The reports give no common measurement window or transaction- or victim-level cross-reference. Their figures therefore cannot be added or treated as competing estimates of the same losses.
What Officer’s Notes alleged about Safari
In a post dated November 4, Officer’s Notes alleged that opening an infected website in Safari could run malicious code and expose passwords, messages, photos, cryptocurrency-wallet files and private keys. Incrypted reported the allegation on November 6, citing the post and a Legalblock representative.
What the technical explanations describe
The Defiant also summarized a Trust Wallet warning that DarkSword and Coruna exploit older iOS versions to access wallet data rather than exploiting flaws in wallet apps.
In a separate explainer published April 1, 2026, Seytonic described DarkSword as a chain of six vulnerabilities and said its Ghostblade payload targets messages, call history, Wi-Fi credentials and cryptocurrency-wallet data.
