The March 3, 2026 disclosure of the Coruna exploit kit by Google’s Threat Intelligence Group has forced a serious reassessment of mobile security for cryptocurrency users. Coruna contained five full iOS exploit chains and 23 individual vulnerabilities capable of compromising iPhones running iOS 13.0 through 17.2.1, with a payload specifically designed to exfiltrate cryptocurrency wallet credentials. For advanced users managing significant crypto portfolios on iOS devices, a basic software update is necessary but insufficient. This walkthrough covers the technical configuration of iOS Lockdown Mode, the creation of hardened wallet environments, and the implementation of defense-in-depth strategies that go well beyond default security settings.
The Objective
This tutorial aims to establish a multi-layered security configuration on iOS that neutralizes exploit kits like Coruna even at the operating system level, while maintaining a functional cryptocurrency management workflow. The approach combines Apple’s built-in Lockdown Mode, network-level protections, isolated wallet environments, and operational security practices to create a security posture that withstands both known and unknown mobile threats.
By the end of this walkthrough, you will have a dedicated, hardened iOS configuration for cryptocurrency operations that minimizes the attack surface available to exploit kits, web-based attacks, and local privilege escalation attempts. The configuration is designed to be practical for daily use while providing significantly enhanced protection compared to default iOS settings.
Prerequisites
Before beginning this walkthrough, ensure you have the following: an iPhone running iOS 17.3 or later (to ensure base patching of Coruna-related CVEs including CVE-2024-23222), a hardware wallet such as a Ledger Nano S Plus or Trezor Model T with the latest firmware, a secondary iPhone or iPad dedicated exclusively to cryptocurrency operations if possible, access to your router’s administration panel for network-level DNS configuration, and a basic understanding of iOS Settings navigation and web security concepts.
Optional but recommended tools include a Tor relay for anonymous transaction broadcasting, a Faraday bag for air-gapped device storage, and an Enigma or Cryptosteel seed phrase backup device for physical redundancy.
Step-by-Step Walkthrough
Phase 1: Enabling and Configuring Lockdown Mode
Navigate to Settings, then Privacy and Security, then Lockdown Mode. Toggle Lockdown Mode on and confirm the warning prompt. This immediately disables several iOS features that are commonly exploited: message attachments from unknown senders are blocked, incoming FaceTime calls from unknown numbers are prevented, wired device connections are restricted when the iPhone is locked, and complex web technologies including certain JavaScript just-in-time compilers are disabled. Coruna specifically checks for Lockdown Mode and aborts execution when detected, making this the single most effective mitigation against the kit.
After enabling Lockdown Mode, configure its per-app exclusions carefully. For each cryptocurrency wallet app you use, evaluate whether it requires web browsing capabilities. MetaMask, for example, uses an in-app browser that could be excluded from Lockdown Mode protections if you enable the exclusion. Resist this temptation. Instead, use the wallet app only for signing transactions that you initiate through a separate, hardened browser session.
Phase 2: Network-Level Hardening
Configure your home router to use a DNS filtering service that blocks known malicious domains. Services like NextDNS, Cloudflare Gateway, or Quad9 provide malware domain filtering at the DNS level. This adds a network-layer defense against exploit delivery, since Coruna was delivered through compromised domains. Configure your router’s DHCP settings to distribute the filtered DNS servers to all connected devices automatically.
For on-the-go protection, install a trusted VPN application that includes DNS filtering capabilities. WireGuard paired with a self-hosted VPN server running Pi-hole provides the most control, but commercial options like Mullvad with its DNS blocking feature offer a simpler setup.
Phase 3: Creating an Isolated Wallet Environment
If using a dedicated device for crypto operations, perform a clean iOS installation by erasing all content and settings, then restoring only your wallet applications from the App Store. Do not install social media apps, games, or unnecessary utilities on this device. Each additional app increases the attack surface.
Disable Safari on the crypto device using Screen Time restrictions. Navigate to Settings, Screen Time, Content and Privacy Restrictions, Allowed Apps, and toggle Safari off. Use a hardened browser like Brave with script blocking enabled for any web3 interactions, and close it completely after each session.
Configure automatic iOS updates to install overnight. Navigate to Settings, General, Software Update, and enable Automatic Updates for both iOS updates and Security Response and System Files. This ensures that security patches, including those for vulnerabilities targeted by exploit kits, are applied as quickly as possible.
Phase 4: Transaction Workflow Hardening
Establish a strict transaction workflow that minimizes exposure. When connecting your wallet to a decentralized application, always verify the contract address and chain ID in the signing request. Never sign transactions that request unlimited token approvals. Use a dedicated approval management tool to set specific spending limits before interacting with any new protocol.
For high-value transactions, implement a two-device verification process: review the transaction details on one device, then sign on the hardware wallet while comparing the details displayed on the hardware wallet screen with those shown on the software interface. This protects against man-in-the-browser attacks that could modify transaction parameters between display and signing.
Troubleshooting
If wallet applications behave unexpectedly under Lockdown Mode, this is expected behavior. Lockdown Mode restricts certain web technologies that some wallet apps rely on for their in-app browsers. The solution is to separate the browsing layer from the signing layer: use a standard browser for interacting with dApps, and use the wallet app exclusively for signing the resulting transactions.
If DNS filtering causes legitimate dApp connections to fail, check the DNS filter logs to identify which domains are being blocked. You can whitelist specific domains while maintaining protection against known malicious infrastructure. Common legitimate domains for DeFi interactions include the RPC endpoints for Ethereum mainnet and the API endpoints for wallet connectivity.
If iOS updates fail to install automatically, check that your device has sufficient storage space and is connected to Wi-Fi and power during the scheduled update window. Security Response updates are particularly small and should install without issue on most devices.
Mastering the Skill
The configurations described in this walkthrough represent a strong baseline, but true mobile security mastery requires ongoing adaptation. Subscribe to Apple’s security-announce mailing list to receive immediate notification of new iOS security updates. Follow security researchers who specialize in mobile exploit research, particularly those who track commercial surveillance vendors and exploit kit proliferation.
Periodically audit your security configuration by reviewing Lockdown Mode exclusions, checking DNS filter logs for blocked connection attempts, and verifying that all wallet applications are running their latest versions. Consider conducting quarterly security reviews where you evaluate whether your current configuration still meets the threat landscape.
The Coruna exploit kit demonstrated that even sophisticated, government-grade exploits can proliferate to financially motivated attackers targeting cryptocurrency users. By implementing the defense-in-depth approach outlined in this tutorial, you establish a security posture that remains effective even as the threat landscape evolves.
Disclaimer: This article is for educational purposes only and does not constitute financial or security advice. Always conduct your own research and consult with security professionals for personalized guidance.
Lockdown Mode breaks a lot of iMessage and web features but for a dedicated wallet device its worth the tradeoff
disabling iMessage is the hardest sell for most people. i ended up using a dedicated iPod touch as my wallet device. not cheap but cheaper than losing my stack
Mika Virtanen a dedicated device is the move. i picked up a used iphone 12 for 150 bucks and it never touches wifi except for firmware updates. cheaper than one lost seed phrase
airgap_nun_ 150 bucks for a used iphone 12 as a cold wallet is cheaper than one ledger replacement after the data breach. dedicated device is the move
lockdown_mode_on the tradeoff is worth it for a wallet only device. but apple really should let you toggle individual restrictions instead of all or nothing
Mads B. apple letting you toggle individual restrictions would solve everything. blocking all of iMessage for a wallet device is using a sledgehammer for a scalpel job
jonas_hw using a sledgehammer for a scalpel job is the perfect description. Apple forcing all-or-nothing lockdown mode when most people just need wallet-specific protections
Anniken B. the sledgehammer metaphor is perfect. apple forcing all or nothing lockdown mode when wallet apps need targeted protection is lazy design
23 vulnerabilities in one exploit kit and 5 full iOS chains. Coruna was basically a Swiss army knife for wallet theft. Lockdown Mode disables the exact attack surfaces they targeted
5 full iOS exploit chains in one kit targeting crypto specifically. the ROI for attacking mobile wallets has clearly exceeded the development cost at this point
threat_model_ 5 exploit chains targeting crypto wallets specifically means the development cost was already justified by expected theft. mobile wallet users need to take this seriously or move to hardware
opsec_daily the fact that Lockdown Mode disables exactly the surfaces Coruna targeted (iMessage attachments web fonts JIT) tells you Apple designed it with this threat class in mind. too bad most users wont enable it until after they get drained
Tyra E. lockdown mode disables exactly what Coruna targeted but most people wont enable it because it breaks iMessage and safari. apple should make a wallet-only mode
defense in depth on iOS is finally getting the attention it deserves. the isolated wallet environment section is particularly useful
The network-level protections section is something most guides skip. VPN plus DNS filtering on a wallet-only device is underrated.
the isolated wallet environment on a separate device is overkill for most people but if youre holding 6 figures plus in crypto its honestly the bare minimum
Ravi Krishnan DNS filtering on a wallet only device is so underrated. most people focus on the app layer and completely ignore that a malicious DNS resolver can redirect your RPC calls to a fake node
vpn_purist_ the DNS redirect attack on RPC endpoints is genuinely terrifying. fake node accepts your signed tx, fronts runs you, and you never see the real mempool. lockdown mode alone doesnt fix this
vpn_purist_ fake RPC nodes are the scariest attack vector imo. your signed tx goes straight to the attacker and you never even see the real mempool
5 exploit chains targeting wallet seed phrases specifically. Coruna wasnt some generic spyware it was purpose built for crypto theft. the development cost alone means the expected haul was massive
coruna_skeptic_ 5 exploit chains cost minimum 2.5M to develop. means the expected crypto theft haul was north of 25M. mobile wallets are the soft target
5 full exploit chains targeting crypto wallets specifically. the development cost alone means someone was funding this for the expected theft ROI. mobile wallet users are the soft target
the fake RPC node attack is the one nobody talks about. you sign a tx thinking its going to mainnet and its going to a hostile node that front runs you instantly
rpc_nope_ fake RPC nodes are why I run my own endpoint now. trusting someone elses RPC with signed transactions is like handing blanks to a stranger and hoping they dont swap them
23 vulnerabilities in one kit and 5 full chains for iOS 13 through 17. Coruna was basically a warehouse of exploits aimed squarely at crypto wallets. anyone not on lockdown mode with significant holdings is asking for it
cve_watcher_ 23 vulns in one kit means Apple’s bug bounty program is massively underpriced. if Coruna sold each chain for $500K that is $2.5M from a broker who pays way less than black market rates