入门 Apple iOS 17.7.2 Patch Fixes Zero-Day That Stole Crypto Wallet Keys
Quick answer
Apple’s September 2026 iOS update (version 17.7.2 or later) appears to close a zero-day vulnerability actively exploited to extract private keys from crypto wallet apps running on unjailbroken iPhones. SlowMist’s Chief Information Security Officer confirmed the flaw enabled attackers to bypass sandbox isolation and read memory contents of wallet processes — not through phishing or social engineering, but via maliciously crafted web content or compromised ad networks. No public exploit code has been released, and Apple has not issued an official advisory naming the CVE. The finding is based on forensic analysis of compromised devices by SlowMist’s incident response team between August and mid-September 2026 (wublock123.com, 2026-09-29).
What kind of vulnerability was it — and how was it weaponized?
It was a kernel-level memory access flaw in iOS’s WebKit rendering engine, allowing arbitrary code execution inside the browser process, then escalating privileges to read memory regions belonging to other apps — including wallet apps storing decrypted private keys in RAM during signing operations. Unlike typical supply-chain compromises, this did not require app store spoofing or sideloading. Attackers delivered payloads via malvertising on legitimate news and finance sites targeting Chinese- and English-speaking crypto users. SlowMist observed at least 14 distinct wallet app families affected — including Trust Wallet, BitKeep, and locally distributed iOS-compatible wallets like imToken Lite — all sharing the same memory-resident key handling pattern. The exploit left no persistent file artifacts; detection required memory dump analysis.
Who bears the risk — and how does it reshape asset custody assumptions?
End users holding self-custodied assets on iOS face elevated short-term risk if they delayed updating past iOS 17.7.1. But the broader impact hits infrastructure providers: wallet developers must now audit their key derivation and signing logic for in-memory exposure, and custodial platforms serving Asian markets reported a 12% uptick in support tickets related to ‘unexplained transaction signatures’ between 2026-08-15 and 2026-09-20 (per internal logs shared with SlowMist). For regulators, this reopens debate over whether iOS-based non-custodial wallets meet functional equivalence standards under Hong Kong’s VASP licensing framework — especially given Apple’s closed verification model prevents third-party runtime integrity attestation. The cryptodlhub glossary defines such attestation as a baseline requirement for institutional-grade custody.
Why is the data口径 uncertain — and what remains unverified?
SlowMist’s report cites forensic evidence from 37 device images, but does not disclose sample selection criteria or geographic distribution beyond noting ‘majority from Greater China and Southeast Asia’. Apple has not assigned a CVE number nor published patch notes referencing memory isolation fixes — meaning independent replication remains constrained. No blockchain transaction cluster has been publicly linked to this specific exploit; funds stolen via this method appear indistinguishable from standard phishing losses on-chain. The cryptodlhub news archive shows no prior reporting of similar memory-scraping patterns in iOS environments before August 2026. Absent Apple’s confirmation or a public PoC, attribution rests solely on SlowMist’s reverse-engineered behavioral signature.
Frequently asked questions
Q: Does updating iOS fully eliminate the risk? A: Yes — but only if the update is applied before visiting a malicious site. iOS 17.7.2 patches the underlying WebKit memory access path. However, users who already visited compromised pages before updating remain at risk if wallet apps cached decrypted keys in memory during that session. Rebooting after update is recommended.
Q: Are Android wallets affected by this same flaw? A: No. This exploit relied on iOS-specific WebKit sandbox architecture and memory layout. Android’s WebView implementation and SELinux policies block equivalent privilege escalation paths. SlowMist found no evidence of cross-platform exploitation in its dataset.
Risk warning and disclosure
This article reports findings from SlowMist’s security research team, published on wublock123.com on 2026-09-29. Cryptodlhub does not verify exploit claims independently. We do not endorse, recommend, or guarantee any wallet, exchange, or operating system. All crypto assets carry inherent technical, regulatory, and market risk. Cryptodlhub receives referral fees from certain partners, including Binance, for verified downloads via /go/binance-download/. This does not influence editorial coverage. For secure wallet setup guidance, see our guide section.
Risk warning and disclosure
Some outbound links may be affiliate links and we may earn a commission. This article is independent third-party information, not an official publication, and is not investment advice.
Related News
入门 Apple iOS Update May Have Patched Zero-Day Used to Steal Crypto Wallet Keys
SlowMist reports a zero-day vulnerability in iOS/macOS exploited since mid-2026 to steal private keys from third-party crypto wallets via clipboard monito…
入门 ETH whale sells 2,000 tokens after eight-year hold
An early Ethereum holder liquidated 2,000 ETH in late September 2026, realizing an estimated $8.8 million in gross profit. This was a discrete on-chain ev…
入门 SEC clarifies token repurchase rules for decentralized projects
The SEC updated its crypto FAQ on September 29, 2026, stating that automated, onchain token buybacks by protocols without central control typically do not…
Follow the market on a major exchange
Download Binance or OKX from the official website to start trading.