A compact $19 power bank from Guangzhou airport spent three weeks copying the contents of an iPhone and sending files to a third-party server. The incident, uncovered during an independent technical investigation, demonstrates the scale of the threat faced by cryptocurrency holders: access to wallets, exchange apps, and photos containing seed phrases were all at risk.

On first connection, the iPhone requested confirmation of trust in the device. The smartphone correctly warned that what was plugged in was not a charger but a gadget capable of reading data. The user tapped "Trust" — and the episode was forgotten. A normal charger uses only the power lines in a USB cable, but this battery also used the data transfer lines.

During operation, the device copied:

  • the IMEI and serial number of the phone;
  • 1206 contacts;
  • a list of apps, including two banking ones;
  • 3912 photos, among them a photo of a passport;
  • the name of the home Wi-Fi network and its password.

The owner's wife's iPhone was also affected — she too charged from the battery and confirmed trust. Using the Wi-Fi password, the device connected to the internet from the home and uploaded new files. Over three weeks, 19 such uploads were recorded, the last one at night while the family was asleep.

What was found inside

Monitoring of file access on the phone showed that ten seconds after charging began over the cable, data started flowing, even though only current should have been flowing. The cable was immediately disconnected, the server address was blocked on the router, and the Wi-Fi password and banking app logins were changed.

Disassembly of the casing at a repair shop revealed a miniature computer with its own Wi-Fi module, while the real battery capacity turned out to be less than a third of what was claimed. Three battery cells provided about 9100 mAh instead of the stated 30,000 mAh. The empty space was filled with foam, and two glued-on metal weights created the illusion of a real battery's weight. According to the technician, this was already the third such power bank on his bench in a month.

The danger is not limited to banking apps. Phones often store screenshots of seed phrases, wallet and exchange apps, and two-factor authentication codes. A set of photos, contacts, and a serial number is enough to withdraw funds or impersonate the owner.

How to check power banks

Every battery in the home should be tested through an old laptop: connect it with your own cable and request a check in "read-only" mode, without opening, launching, or copying anything. A normal power bank either does not show up at all or is detected as a charger. If it appears as a storage drive, keyboard, network adapter, or camera — that is a red flag. Next, check the manufacturer and product identifiers, the appearance of new drives, network connections, or keyboards, as well as the absence of spontaneous key presses and launches.

Some users online doubted the veracity of the story, pointing to technical inconsistencies, the hidden logo and server IP address, and the unprofitability of selling a device with 64 GB of storage and a Wi-Fi module for $19. However, the main conclusion remains indisputable: a charger should never request trust in a computer — when such a window appears, you must tap "Don't Trust." Tapping "Trust" grants access to a full iPhone backup.

Cryptalist analysis: The incident illustrates a shift in the attack vector from software vulnerabilities to physical peripherals — accessories that users traditionally perceive as safe. For holders of digital assets, this is a signal to revisit operational hygiene: storing seed phrases and 2FA codes on a smartphone turns any compromised gadget into a direct channel for stealing funds. As retail crypto adoption grows, the market for hardware threats will expand, strengthening demand for hardware wallets and segmentation of devices by data sensitivity level.