The malware utilized two specific components, apptrace and libapptracecore, to perform remote configuration and collect private keys and seed phrases from the device. This breach used a kernel exploit to gain high level device privileges, specifically affecting those on iOS 26.x or earlier. Affected users are advised to delete the app and transfer assets to a new wallet created on a separate, untainted device.
