A new iPhone threat called Coruna is turning a phone security story into a crypto fear story, and for many users, that may be the real danger. Google says Coruna is a powerful iOS exploit kit with 23 exploits and five full attack chains that can target iPhones running iOS 13 through iOS 17.2.1. That means a huge range of older Apple phones could be exposed if they have not been updated. The worst part is how this toolkit spread. Google first saw parts of it in a targeted surveillance case, then in attacks aimed at Ukrainian users, and later on fake Chinese finance and crypto sites built to pull in iPhone visitors.
That shift matters. A tool once used in narrow spy work now appears in broader criminal campaigns. In plain terms, a high-end iPhone break-in kit seems to have moved from the shadows into scam websites that can hit regular users. That is where crypto holders should pay close attention.
The fake sites pushed iPhone users toward hidden exploit pages. Once a victim landed there, Coruna could fingerprint the device, pick the right exploit, and try to break through browser and system defenses. Google said the kit even checked whether the phone was in Lockdown Mode or private browsing and would back off in some cases. That tells you the attackers were not sloppy. They were careful, patient, and built for real-world use.
The ending payload is where the story gets darker for crypto users. Google found malware modules aimed at popular wallet apps including MetaMask, Phantom, Trust Wallet, Exodus, Uniswap Wallet, TronLink, BitKeep, TokenPocket-style apps, and TON wallets. The malware could scan images for QR codes, search text for BIP39 seed phrases, and look for terms such as “backup phrase” and “bank account.” In other words, it was not just stealing random data. It was hunting for the keys to your money.
Some of the recovered Chinese log messages make that clear. One line translates to “CorePayload manager initialized successfully, trying to start.” Another says, “Heartbeat monitor started, waiting for CorePayload to send the first heartbeat.” Those are not the words of a rough scam page. They point to a working theft platform built to stay active, collect data, and pull in more modules later.
This is why the Coruna story links so easily with the crypto market. Self-custody gives users control, but it also puts risk on the device in their hand. If your seed phrase lives in Notes, screenshots, photos, or chat backups on an older iPhone, a phone exploit can become a wallet drain. The market price then adds another layer of pain. On March 6, 2026, Bitcoin traded around $68,230 to $69,880, down about 3.9% on the day, with daily volume near $44.7 billion. Ethereum traded around $1,979 to $2,081, also down on the day, with volume around $20.0 billion. That price and volume picture shows a weak tape: sellers still have control, volume is heavy, and fast drops can turn one security mistake into a much bigger portfolio loss.
Think about what that means for a real holder. If one stolen seed phrase leads to the loss of 1 BTC, the damage is roughly $68,000 to $70,000 at current prices. Lose 10 ETH and the hit is close to $20,000. If the attacker gets into several wallet apps, the loss can stack fast across chains, tokens, and stablecoins. In a shaky market, stolen funds may be dumped quickly, adding more sell pressure while the victim watches both access and value disappear.
There is one piece of good news. Google said Coruna does not work against the latest iOS version. Apple had already fixed several linked bugs in past updates, and Google urged users to update iOS right away. If an update is not possible, Lockdown Mode adds another layer of defense. That may sound basic, but this story shows why basic steps matter. A phone that feels safe because it is an iPhone may still be the weakest link in a crypto setup.
For crypto users, the warning is simple and ugly: the next wallet wipe may not start with a bad token or a fake airdrop. It may start with one visit to a poisoned website on an old iPhone. In a market already under pressure, Coruna is the kind of threat that can turn paper losses into permanent losses.
