Crypto never sleeps. Moreover, neither do the risks around it.
As always, we keep an eye on macro events, crypto highlights, and airdrop updates. That is what you need to stay in the loop on the stories that could affect your bags, your trades, or even your DCA strategy. Yesterday, we covered the physical robbery of $24 million and talked about security measures crypto users should take. Today, we stay on that same theme with another serious reminder: digital security matters just as much as real-world security.
This time, the spotlight is on an iPhone exploit that could put crypto users at risk. At the same time, we also have fresh airdrop claim updates, a new Justin Sun SEC settlement, a bizarre case tied to seized government crypto, a major OKX valuation jump, fresh legal trouble for Pudgy Penguins, and another rough stat for Bitcoin.
Let’s get into it.
1] iPhone exploit becomes a real threat for crypto users
The keyword today is iPhone exploit, and for good reason.
Google researchers recently detailed a dangerous framework called Coruna, which has been used in several campaigns since 2025. This exploit kit is not some low-level scam page. Instead, it appears to be a serious mobile attack toolkit with the ability to target iPhones across a wide range of versions, from iOS 13 up to iOS 17.2.1.
According to the findings, Coruna includes five full exploit chains and 23 separate vulnerabilities. That alone is already alarming. However, what makes this even more dangerous is how targeted the framework appears to be. Once a victim lands on a malicious site, the exploit can fingerprint the device, detect the exact iPhone model, check the software version, and then choose the best exploit path.
That is bad news for anyone who handles crypto from their phone.
Why this matters for wallet security
For many crypto users, the smartphone has quietly become a second vault. People store wallet apps, exchange logins, 2FA apps, screenshots, photos, notes, and private communication all on one device. That setup is convenient. However, it also creates a huge attack surface.
In this case, the malicious payload tied to the iPhone exploit can reportedly scan images and files for terms like backup phrase or bank account. In other words, if someone saved their seed phrase in screenshots, notes, or files, they may be putting themselves in serious danger.
That is one of the biggest takeaways here.
A lot of users still think the main threat is a phishing link asking them to connect a wallet. Yet this goes much deeper. If an attacker compromises the device itself, they may not need a wallet connection popup at all. They can simply go hunting for the information they need.
Once recovery phrases or private financial data are stolen, the damage can happen fast. Funds can be moved off wallets quickly, and in many cases the victim only notices when it is already too late.
From fake crypto sites to broader cybercrime use
One of the more interesting details is how Coruna has reportedly been spread.
In observed campaigns, it was deployed through fake gambling and cryptocurrency websites made to lure iPhone users. That fits a pattern we have been talking about for a while. Crypto users are often early adopters, active online, and more likely to interact with new tools, new dApps, new casinos, new mints, or new market opportunities. Sadly, that also makes them a prime target.
At the same time, attackers did not limit themselves to crypto-only themes. They also used other landing pages to broaden the victim pool. Still, digital asset holders remained a major focus.
This is why security hygiene matters so much. It is not only about avoiding obvious scams. It is also about understanding that the attack can start with something that looks normal, loads fine, and only needs one visit.
The bigger shift behind the iPhone exploit story
What makes this update especially important is the evolution of the tool itself.
Google’s investigation suggests Coruna first appeared in 2025 in targeted surveillance operations. At that stage, the goal seemed more aligned with tracking specific individuals than stealing crypto at scale. Later, it was reportedly seen in watering-hole attacks aimed at Ukrainian users, with researchers linking those campaigns to a suspected Russian espionage group.
After that, the same toolkit appears to have moved into financially motivated operations linked to China.
That progression matters.
It shows how spyware-grade tools do not always stay in one lane. A framework that starts in surveillance or geopolitical operations can later be used by cybercriminals looking for profit. Once these tools leak, spread, or get shared, the line between nation-state capability and criminal exploitation gets blurry very fast.
For crypto users, that means mobile attacks are no longer some niche concern. They are becoming part of the mainstream threat landscape.
What crypto users should do right now
The good news is that researchers say the Coruna framework does not work on the latest iOS versions, because the exploited flaws were patched. So yes, updating matters. A lot.
If you are active in crypto and use an iPhone, there are a few obvious lessons here.
First, keep your device updated as soon as security patches are available. Delaying updates may feel harmless, but it can leave a known door wide open.
Second, never store recovery phrases in screenshots, image folders, or note apps. That habit is still way too common.
Third, be extra careful with unfamiliar crypto, gambling, and finance-related websites. Even if a page looks polished, that does not make it safe.
Finally, separate convenience from security. It may be easy to manage everything from one phone, but storing too much sensitive data on a single device raises the risk if that device is ever compromised.
The broader point is simple. Mobile security is now crypto security.
2] Airdrop updates: claims are live now
On the airdrop side, this is your reminder that staying updated matters.
Missing one claim window can cost more than months of farming effort. That is exactly why we are putting more focus on our updated newsletter format. We now share more alpha, more timely news, and also important airdrop claim reminders so you do not miss the moments that actually matter.
If you want the important stuff in one place, that is one of the easiest ways to stay ahead.
Right now, these claims are live:
Paradex $DIME claim live
Paradex users should check whether they are eligible for the $DIME claim. If you farmed the platform, now is the time to verify your allocation and make sure you do not miss the window.
Opinion Labs S1 claim live
Opinion Labs season 1 claim is also live. As always, these claims can get overlooked if you are farming multiple ecosystems at once, so it is worth checking as soon as possible.
Avantis S2 claim live
Avantis season 2 is live as well. If that was on your watchlist, go verify now instead of assuming you will remember later.
And yes, this is also the perfect moment to use our airdrop eligibility checker. If you are farming across many chains and protocols, keeping track manually gets messy fast. The checker helps you spot where you may already qualify, which makes the whole process easier and reduces the chance of leaving money on the table.
Unclaimed Airdrops Checker
Last week we launched a free unclaimed airdrops checker.
If you farmed in the past, you might be sitting on money and not even know it.
Don’t let laziness cost you free tokens.
Related: Check these MegaETH airdrop farms
3] Justin Sun settles SEC fraud case for $10 million
Justin Sun is back in the headlines again.
He has reached a $10 million settlement to resolve the SEC civil fraud case tied to his trading activity. The agreement still requires court approval, and according to the filing, neither Sun nor his companies admitted or denied wrongdoing.
The original SEC case, filed in March 2023, accused Sun and his companies of illegally distributing tronix and bittorrent, inflating trading activity, and hiding payments to celebrity promoters. The SEC also claimed Sun generated $31 million through fraudulent trades by having employees conduct wash-style transactions between accounts he controlled.
The case was put on hold in early 2025, not long after Donald Trump returned to the White House, as the SEC explored a possible resolution.
This story matters for a few reasons.
First, it shows once again how quickly the mood around crypto regulation can shift depending on the political environment. Second, Justin Sun remains one of the most controversial figures in crypto, yet he also remains deeply connected to major narratives, power circles, and liquidity flows. That combination keeps him relevant whether people like it or not.
The settlement may close one chapter, but it does not erase the broader debate around market manipulation, celebrity shilling, and selective enforcement in crypto.
Related: Read more about the Uniswap case that got dismissed
4] Son of government contractor arrested over alleged seized crypto theft
This one sounds almost unreal, but it is one of the strangest stories in crypto right now.
John “Lick” Daghita was arrested in Saint Martin in a joint FBI and French operation after allegations that he siphoned tens of millions of dollars in crypto from U.S. government seizure wallets. Investigators say the case is tied to wallets managed through his father’s company, a contractor involved in supporting government agencies with seized crypto operations.
The reported amount is massive. Authorities allege more than $46 million may have been diverted.
The investigation reportedly began after blockchain investigator ZachXBT flagged a wallet holding around 12,540 ETH, which was allegedly linked to Daghita. From there, the U.S. Marshals Service started digging deeper.
There are a few layers to this story.
On one hand, it is another reminder that blockchain leaves trails. On the other hand, it is also a reminder that custody risk exists everywhere, including in places that are supposed to be secure. Crypto users often worry about shady exchanges, scammers, and wallet drainers. Yet sometimes the biggest failures happen around insiders, access control, and poor oversight.
That is not only a crypto problem. It is a systems problem.
5] ICE investment pushes OKX to a $25 billion valuation
One of the more bullish business headlines this week is the new OKX valuation.
After a minority investment from Intercontinental Exchange, the parent company of the New York Stock Exchange, OKX is now being valued at $25 billion. That is a serious number and another sign that large financial players want exposure to crypto infrastructure.
The partnership goes beyond headline value too.
ICE will license OKX spot prices and launch U.S.-regulated futures contracts. Meanwhile, OKX will distribute ICE’s U.S. futures and tokenized equities markets to its global user base.
That is a meaningful bridge between traditional finance and crypto.
It also signals something bigger. Wall Street is no longer watching crypto from the sidelines. It is actively building around it. Whether people are bullish or bearish in the short term, that structural trend is hard to ignore.
Personally, I may move some funds to OKX just to spread risk across centralized exchanges. In a bear market, you never fully know which platform will stay strongest over time. So if an exchange just raised at that kind of valuation and brought in a player like ICE, that at least adds some confidence that it is healthy enough to park part of a balance there. You can do the same by using our link.
Of course, diversification across exchanges is still not the same as self-custody. However, from a practical risk-management view, spreading funds can make sense.
6] Pudgy Penguins hit with trademark lawsuit
Pudgy Penguins is facing legal trouble after PEI Licensing, the company behind the Original Penguin brand, filed a trademark infringement lawsuit.
PEI claims Pudgy Penguins used penguin-related word marks and designs in ways that could confuse consumers. The complaint argues that the crypto brand’s apparel and related branding may mislead buyers into thinking there is some association between the two companies.
The case also points to prior efforts by PEI to stop the issue earlier. According to the filing, a cease-and-desist letter was sent in October 2023, and opposition notices were filed in 2024 against some Pudgy trademark applications.
Pudgy Penguins, for its part, says it was surprised by the lawsuit and believes the claims lack merit. Its legal team argues that the marks are visually distinct and aimed at different audiences.
This is a notable case because Pudgy Penguins has grown far beyond a simple NFT collection. It now sits in that tricky zone where crypto IP meets mainstream consumer branding. Once a project enters toys, apparel, retail shelves, and global merchandising, it also enters a very different legal arena.
That is where strong community branding is no longer enough. Trademark law starts to matter in a serious way.
7] Bitcoin posts a rough streak, but there are mixed signals
Bitcoin has now closed five consecutive months in the red, marking its longest bearish streak since the 2018 to 2019 period.
That stat sounds ugly, and it is. Sentiment has clearly been weighed down by geopolitical tension, regulatory concerns, and broader macro uncertainty. When energy markets get shaky, war risk rises, and policy direction remains unclear, crypto does not trade in a vacuum.
At the same time, there are some counter-signals.
Institutional flows improved late in February, with a reported $881 million inflow during the week ending February 27. That suggests larger players may be regaining some confidence after a period of heavy outflows.
There is also a view that the retreat in hot capital lowers some short-term sell pressure. In simple terms, less speculative fast money can sometimes create a calmer market structure.
Still, price remains stuck in a tough zone. Bitcoin has been trading in a range, and until it breaks convincingly, traders are left dealing with the same problem many have faced lately: lots of setups, lots of fakeouts, and not enough clean trend follow-through.
That is why patience still matters here. We discussed our trading view of it 2 days ago.
Support Our Work
If you found this helpful, consider signing up on BloFin (Non-KYC) or Bybit using our referral links. Your support keeps this content free and flowing.
Final thoughts
This was one of those news cycles where security stood out more than anything else.
The iPhone exploit story is a serious reminder that crypto risk is no longer only about bad tokenomics, bad entries, or obvious phishing links. Your mobile device itself can become the weak point. If your phone is compromised, your wallet may already be at risk before you even realize it.
At the same time, the broader crypto market keeps moving. Airdrop claims are opening, high-profile legal cases are settling, major exchanges are raising at huge valuations, and even meme-native brands like Pudgy Penguins are finding out what happens when crypto starts colliding with traditional business law.
So yes, stay informed. However, more importantly, stay sharp.
Update your phone. Check your claims. Spread your exchange risk. And do not assume convenience equals safety.
If you enjoyed this blog, you may want to check our other crypto news updates.
As always, don’t forget to claim your bonus below on Bybit. See you next time!
Credit: Source link
