Read this article on bsc.news Binance founder Changpeng Zhao (@cz_binance) has urged iPhone users to update their phones' software immediately, pointing out that no wallet app can update a ph
Binance founder Changpeng Zhao (@cz_binance) has urged iPhone users to update their phones' software immediately, pointing out that no wallet app can update a phone's operating system for its owner. He also drew attention to a separate, newly patched flaw in OpenSSH, the remote login tool widely used on servers.
The warning follows reports that a newer version of DarkSword, an iOS exploit kit, is being used against crypto holders. According to The Crypto Times, security firm CertiK said the kit can target unpatched iPhones through malicious websites opened in Safari, with no wallet connection or transaction signature needed. Because the attack targets the device rather than a specific app, switching wallets may not protect credentials stored on a compromised iPhone.
CertiK said researchers had reported that the kit's source code was being offered for sale, and advised users to install the latest iOS update and avoid storing seed phrases in Photos, Notes or screenshots.
Phemex reported that security researchers put losses at $5.57 million across more than 20 wallets, with at least 18 malicious websites identified. The same report quoted Zhao saying that no wallet software can update the operating system on a user's behalf. These loss figures come from a secondary report and should be treated with caution.
DarkSword was first documented publicly earlier this year. Startup Fortune noted that Google Threat Intelligence Group described it in March as a full-chain iOS exploit used by multiple threat actors since at least November 2025.
Zhao also flagged a flaw in OpenSSH that let attackers into some Alpine Linux servers by submitting a very long password. The Hacker News reported that attackers could log in to accounts with no password, such as SSH key-only accounts, using a password between 257 and 1,024 bytes long. They also need network access to the server and an account name.
OpenSSH released version 10.6p2 on November 5 to address the issue, which is tracked as CVE-2026-123158 and rated 8.1 out of 10 on the CVSS 3.1 scale, according to iTnews. Alpine Linux has published patched packages for every branch back to version 3.16. Administrators must restart sshd after upgrading, and turning off password authentication also closes the hole.
The bug traces back to a July 2016 OpenSSH change, according to SQ Magazine, which is consistent with the roughly decade-long window before it was found. Damien Miller of the OpenSSH project said systems that are not Linux, that use glibc, or that check passwords through PAM are not affected.
For crypto users, the practical advice is the same in both cases: install available updates, keep seed phrases off connected devices, and treat device-level security as part of self-custody.
Sources
The Crypto Times: CertiK warns DarkSword iOS exploit can target crypto walletsThe Hacker News: OpenSSH issues emergency fix for Alpine Linux flawiTnews: Lightweight Linux distros vulnerable to sshole password bypass
