iCloud-backup MetaMask seed-phrase cohort — multi-chain (EVM-dominant) — 2022-04 (canonical Iacovone case) onward

Summary

MetaMask is one of the most widely-deployed self-custodial Ethereum / EVM wallets, with mobile-app distributions on both iOS and Android. The MetaMask iOS app stores its encrypted vault — containing the password-encrypted seed phrase and account state — in app-scoped data on the iOS device. Through the relevant 2022 product window and continuing thereafter, iOS Backup at the device level (iCloud Backup) is enabled by default at iOS first-time setup, and the default behaviour includes app-scoped data such as MetaMask's encrypted vault unless the app has explicitly opted out via UIDocument.disableBackup / NSURLIsExcludedFromBackupKey. As of April 2022 (and at v0.1 reporting horizon for many wallet vendors), MetaMask's iOS app had not opted out of the iOS Backup behaviour for the encrypted vault data — meaning that any iOS user with iCloud Backup enabled (the default) auto-synced the encrypted MetaMask vault to iCloud as part of the device-level iCloud Backup.

The vault encryption is user-password-bound: the user-supplied password is the input to the vault-decryption-key derivation, and an attacker with access to the encrypted vault can brute-force the password offline if the password is weak or reused. For users with strong, unique vault passwords, the encrypted-at-rest cloud-backup is approximately as secure as the password's strength; for users with weak or reused passwords, the vault is exposed once the encrypted bytes leave the user's device.

On April 15, 2022, NFT collector / former DJ Bedtime contributor Dominic Iacovone (Twitter handle revive_dom) publicly reported the loss of approximately $650K-$655K in cryptocurrency and NFTs from his MetaMask wallet. The attack onset was a sophisticated Apple ID phishing campaign:

• Iacovone received multiple SMS messages requesting that he reset his Apple ID password.
• He subsequently received a phone call with caller-ID spoofing identifying as Apple Support, claiming his Apple ID had been compromised and requesting a six-digit verification code that had just been sent to his phone (the code was the legitimate Apple two-factor authentication code, but the request was an attacker reading it back out of the legitimate Apple authentication flow).
• Iacovone provided the six-digit code, granting the attacker access to his iCloud account.
• The attacker accessed the iCloud Backup containing the MetaMask vault, brute-forced the vault password offline, and drained the wallet of approximately $650K-$655K in ETH, ERC-20 tokens, and NFTs.

Two days later, on April 17, 2022, MetaMask's official Twitter account posted a public security warning advising iOS users to disable iCloud Backup for MetaMask app data:

"If you have enabled iCloud backup for app data, this will include your password-encrypted MetaMask vault. If your password isn't strong enough, and someone phishes your iCloud credentials, this can mean stolen funds."

The MetaMask thread linked the warning explicitly to the Iacovone case. MetaMask's recommended remediation:

• iOS Settings → Apple ID → iCloud → Manage Storage → Backups → toggle off MetaMask backup.
• Or: disable iCloud Backup at the device level entirely.
• Use a strong, unique vault password.

The case became a public-record cohort anchor: subsequent reports through 2022–2024 documented additional individual victims of the same attack pattern (iCloud account compromise via SIM-swap, Apple ID phishing, or shared-device theft → MetaMask vault decryption → wallet drain). The cohort-level loss has not been centrally tabulated; documented individual cases include cases in the high-five-figure to mid-six-figure range, with the Iacovone case as the canonical headline anchor.

The cloud-backup-at-rest capability surface is structural to iOS / iCloud and to the default behaviour of mobile-OS app-data backup; the exploitation of the surface is opportunistic and pseudonymous at the cohort level. The case is the canonical v0.1 anchor for the default-on-cloud-backup-as-implicit-custody sub-pattern within the proposed T11.x cold-storage-seed-phrase-exfiltration-at-rest sub-class, complementing the LastPass cohort case in establishing the breadth of the sub-class.

Timeline (UTC)

When	Event	OAK ref
Pre-2022	iOS default behaviour: iCloud Backup enabled by default at first-time setup; MetaMask iOS app stores encrypted vault in app-scoped data without opting out of iOS Backup	(latent surface — default-on-cloud-backup-as-implicit-custody precondition)
2022-04-15	Iacovone receives Apple ID phishing payload (SMS + spoofed-Apple-Support call); provides six-digit code; attacker gains iCloud access; brute-forces MetaMask vault password offline; drains ~$650K-$655K	T11.x cold-storage exfiltration at rest event — canonical anchor case
2022-04-15	Iacovone publicly reports the loss on Twitter (revive_dom handle); cohort-level public-record attribution begins	(public disclosure)
2022-04-17	MetaMask issues public security guidance advising iOS users to disable iCloud Backup for MetaMask app data	(vendor-side response — security guidance)
2022-04-17 onward	Industry press (TechSpot, Decrypt, Cointelegraph, CryptoNews, BleepingComputer, 9to5Mac, HackRead) covers the Iacovone case and the broader cloud-backup capability surface	(cohort-level attribution)
2022 onward	Additional individual cases of iCloud-account-compromise → MetaMask-vault-decryption → wallet drain documented in per-victim Reddit / Twitter testimonies; cohort-level cumulative loss not centrally tabulated	T11.x cohort-level continuation
2022 onward	iOS users of various self-custodial wallets (MetaMask, Trust Wallet, Coinbase Wallet, Phantom, others) face the same default-on-cloud-backup capability surface; wallet-vendor app-data backup behaviour varies across vendors	(cohort-level capability surface)
2023-2024	Continuing cohort cases; no central tabulation; no civil-recovery action against Apple or MetaMask	(cohort drain campaign open)
Continuing	The default-on-cloud-backup capability surface remains active at v0.1 reporting horizon (May 2026); user-side mitigation depends on per-app explicit opt-out or per-user device-level cloud-backup-disable	(open capability surface)

What defenders observed

• Default-on cloud-backup behaviour at the OS level produces a third-party-storage-at-rest custody surface that the user typically does not realise they have created. The user's mental model "I'm self-custodial because I hold my own keys" collapses when the wallet's encrypted vault is auto-synced to a cloud-backup surface tied to a separate identity (the user's Apple ID for iOS / iCloud; Google account for Android; Microsoft account for Windows). The defender lesson is that wallet-app cloud-backup behaviour is a first-class user-side T11 mitigation surface that varies across wallet vendors and across OS versions. Defender practice for any user with non-trivial holdings should include auditing the wallet app's cloud-backup behaviour explicitly and disabling cloud-backup for wallet-app data where the wallet vendor has not opted out at the app level.
• The Iacovone attack chain illustrates the multi-step attack pattern: cloud-account compromise → vault-encryption brute-force → on-chain drain. The attacker did not directly access the MetaMask vault — they first compromised the iCloud account (via Apple ID phishing), then accessed the iCloud Backup containing the vault, then brute-forced the vault password offline, then drained the wallet. The defender lesson is that the defence-in-depth chain has multiple breakable links: cloud-account security (MFA on Apple ID, anti-phishing training, anti-SIM-swap protections) is one link; vault password strength is a second link; wallet-app cloud-backup opt-out is a third link. A failure at any single link can break the chain; conversely, hardening any single link can prevent the realised loss even if the others fail.
• Vendor-side response is asymmetric across the chain. MetaMask issued public security guidance within two days of the Iacovone case; Apple did not publicly engage with the cohort framing. The asymmetry reflects the structural division: the wallet vendor (MetaMask) controls the app-level cloud-backup opt-out behaviour; the OS vendor (Apple) controls the cloud-backup default behaviour at the device level. Neither vendor unilaterally bears responsibility for the cohort losses; the defender lesson is that multi-vendor capability surfaces produce diffuse responsibility shapes that resist clean accountability and that user-side mitigation is the primary recovery surface.
• The default-on cloud-backup behaviour persists at v0.1 reporting horizon (May 2026). iOS Backup remains on by default at first-time setup; many self-custodial wallet vendors have updated their iOS apps to opt out of iOS Backup for vault data, but the behaviour varies across vendors and across app versions. Defender practice for any iOS user with non-trivial crypto holdings should audit the wallet app's iCloud-backup status explicitly (Settings → Apple ID → iCloud → Manage Storage → Backups → check the per-app backup status) and disable cloud-backup for wallet-app data where the app's opt-out behaviour is unclear or absent.
• The cohort-level loss is not centrally tabulated and is likely strongly understated. Unlike the LastPass cohort (which has investigative-journalism coverage and forensic-provider tabulation through Krebs / TRM Labs / ZachXBT), the iCloud-backup MetaMask cohort has only the canonical Iacovone case as a public anchor and a cohort-level body of per-victim testimonies that have not been centrally tabulated. The cohort-level cumulative loss is operationally unknown at v0.1 reporting horizon. Contributors writing future T11.x worked examples in the cloud-backup-at-rest sub-class should report the cohort-tabulation state explicitly and should not over-anchor on the canonical-case loss as the cohort-level loss.

What this example tells contributors writing future Technique pages

• The cold-storage-seed-phrase-exfiltration-at-rest sub-class within the proposed T11.x candidate has multiple per-incident shapes and contributors should preserve the distinction. The LastPass cohort is the user-initiated plaintext-equivalent storage tied to a master password shape; the iCloud-backup MetaMask cohort is the auto-synced encrypted-at-rest cloud storage tied to the user's separate-identity security posture shape. Future cases in the same sub-class may exhibit additional shapes (browser-extension cloud-sync; cross-device sync via wallet-vendor proprietary services; etc.); contributors writing the proposed sub-Technique page should preserve the per-incident-shape distinction explicitly.
• Default-on cloud-backup behaviour as implicit custody is a load-bearing structural observation. Contributors writing the OAK Mitigations layer should pre-position the wallet-app-cloud-backup-opt-out mitigation surface as a first-class user-side T11 control. The mitigation has two operational variants: (a) wallet-vendor explicit opt-out at the app level (the cleaner mitigation; user does not need to take action; the iOS / Android backup mechanism does not include the vault); (b) user explicit opt-out at the device or per-app level (the user-burden mitigation; requires user awareness and ongoing maintenance through OS / app updates).
• Multi-vendor capability surfaces produce diffuse responsibility shapes that resist clean accountability. The iCloud-backup MetaMask cohort is the cleanest v0.1 example: neither Apple nor MetaMask unilaterally bears responsibility for the cohort losses, and the defender / contributor lesson is that user-side mitigation is the primary recovery surface for multi-vendor capability surfaces. Contributors writing future T11.x worked examples involving multi-vendor capability surfaces should report the responsibility-distribution explicitly and should not over-anchor on any single vendor as the responsible party.
• Per-victim cohort tabulation is operationally meaningful even when central forensic-provider analysis is absent. The iCloud-backup MetaMask cohort lacks the Krebs / TRM / ZachXBT central tabulation that the LastPass cohort has; contributors writing future T11.x worked examples in similar cohorts should report the tabulation state explicitly and should not infer cohort-level loss from canonical-case-only data. Where central tabulation is absent, contributors should report the cohort as cohort-tabulation-pending and should solicit per-victim testimonies as ongoing community contribution.
• The chained attack pattern (cloud-account compromise + vault-encryption brute-force + on-chain drain) is structurally informative for the OAK chain-of-causation framework. Contributors writing future T11.x worked examples involving multi-step attack chains should preserve the chain dimension explicitly and should report the per-link mitigation surfaces (cloud-account security, vault password strength, wallet-app cloud-backup opt-out) as a layered set rather than collapsing to a single mitigation.

Public references

• [bleepingmetamaskicloud2022] — BleepingComputer, "Hackers steal $655K after picking MetaMask seed from iCloud backup" (April 2022); primary press-coverage source for the canonical Iacovone case.
• [nineto5macmetamaskicloud2022] — 9to5Mac, "iCloud crypto wallet attack: $650K stolen from trader in seconds" (April 19, 2022); primary press-coverage source.
• [techspotmetamaskicloud2022] — TechSpot, "Crypto wallet MetaMask warns iCloud users to disable backups after $650,000 phishing scam"; primary press-coverage source for the MetaMask security guidance.
• [decryptmetamaskicloud2022] — Decrypt, "MetaMask Warns Users of New Apple iCloud Phishing Scam" (April 2022); secondary press-coverage source.
• [hackreadmetamaskicloud2022] — HackRead, "MetaMask Asks Apple Users to Disable iCloud Backup for Wallet After User Lost $650,000"; secondary press-coverage source.
• [techtimesmetamaskicloud2022] — TechTimes, "Apple Users Warned By MetaMask Over Potential Phishing Attacks Via iCloud" (April 2022); secondary press-coverage source.
• [metamaskicloudguidance2022] — MetaMask official Twitter security guidance thread (April 17, 2022); primary vendor-side source.
• [infosecuritybuzzmetamaskicloud2022] — Information Security Buzz, "MetaMask Crypto Wallet Seeds Exposed In iCloud Backups, $650K Theft Shows"; secondary coverage.

Citations

Existing citation keys reused: none — this is the first OAK example in the iCloud-backup-MetaMask sub-class.

Proposed new BibTeX entries (added to citations.bib as part of this batch):

• [bleepingmetamaskicloud2022] — BleepingComputer primary coverage.
• [nineto5macmetamaskicloud2022] — 9to5Mac primary coverage.
• [techspotmetamaskicloud2022] — TechSpot primary coverage of MetaMask guidance.
• [decryptmetamaskicloud2022] — Decrypt secondary coverage.
• [hackreadmetamaskicloud2022] — HackRead secondary coverage.
• [metamaskicloudguidance2022] — MetaMask vendor-side guidance source.

Discussion

The iCloud-backup MetaMask seed-phrase cohort (canonical Iacovone case, 2022-04-15, plus broader 2022–2024 cohort) is OAK's v0.1 worked example for the default-on-cloud-backup-as-implicit-custody sub-pattern within the proposed T11.x cold-storage-seed-phrase-exfiltration-at-rest sub-class. The case complements the LastPass cohort case at examples/2022-12-lastpass-vault-cohort.md in establishing the breadth of the sub-class: both are third-party-storage-service-at-rest cases, but the per-incident shape differs (user-initiated plaintext-equivalent storage tied to a master password for LastPass; auto-synced encrypted-at-rest cloud storage tied to a separate-identity security posture for iCloud).

The structural significance for the broader T11 framework is the empirical demonstration that default-on cloud-backup behaviour at the OS level is a first-class T11 capability surface. The dominant v0.1 T11 sub-Techniques (T11.001 signing-vendor UI compromise, T11.002 wallet-software distribution compromise, T11.003 in-use multisig contract manipulation) all assume the user has explicitly placed their seed-phrase material in the relevant compromised surface; the iCloud-backup cohort introduces the implicit-custody dimension where the user's seed-phrase material ends up in a third-party-storage surface as a side effect of OS-level default behaviour, without any explicit user action. The defender / Mitigations-layer lesson is that wallet-app cloud-backup opt-out is a first-class user-side T11 control that the v0.1 framework does not currently cover.

The case is operationally instructive in three distinct dimensions: (a) the multi-step attack chain (cloud-account compromise + vault-encryption brute-force + on-chain drain) demonstrates that the defence-in-depth chain has multiple breakable links and that hardening any single link can prevent the realised loss; (b) the multi-vendor capability surface (Apple as OS-vendor, MetaMask as wallet-vendor) produces a diffuse responsibility shape that resists clean accountability and that motivates user-side mitigation as the primary recovery surface; (c) the cohort-tabulation-absence is structurally informative — unlike the LastPass cohort, the iCloud-backup MetaMask cohort lacks central forensic-provider tabulation, and contributors writing future T11.x worked examples in similar cohorts should report the tabulation state explicitly.

The default-on cloud-backup capability surface persists at v0.1 reporting horizon (May 2026). iOS Backup remains on by default at first-time setup; wallet-vendor app-data backup behaviour varies across vendors (some have opted out at the app level via UIDocument.disableBackup; others have not; the per-vendor behaviour is operationally opaque to most users). The same surface exists on Android via Google's auto-backup default and on Windows via OneDrive default-on backup; the cohort-level coverage at v0.1 is iOS / iCloud-dominant because the canonical anchor case is iOS-platform-bound, but contributors writing future worked examples should preserve the breadth across mobile-OS platforms explicitly.

The cohort-tabulation-absence is the structural distinguishing feature versus the LastPass cohort. The LastPass cohort has Krebs (investigative journalism) + TRM Labs (demixing analysis) + ZachXBT (per-victim cohort tracking) as central tabulation surfaces; the iCloud-backup MetaMask cohort has only the canonical Iacovone case as a public anchor and a body of per-victim testimonies that have not been centrally tabulated. Contributors writing future T11.x worked examples in cohorts without central tabulation should report the cohort-tabulation state explicitly (cohort-tabulation-pending) and should solicit per-victim testimonies as ongoing community contribution. The OAK convention should not penalise cohort cases without central tabulation — the cohort exists; the per-victim testimonies are real; the framework's coverage benefits from anchoring the cohort even where central tabulation is absent.

For OAK's broader credibility, including the iCloud-backup MetaMask cohort in v0.1 closes a gap: the v0.1 T11 framework had a single canonical anchor (LastPass cohort) for the third-party-storage-service-at-rest failure surface, and adding the iCloud-backup cohort establishes the breadth of the sub-class across the user-initiated storage and implicit-custody-via-default-on-cloud-backup shapes. The case operationalises the implicit-custody dimension into a live empirical anchor, anchors the architectural distinction between user-initiated and implicit third-party-storage surfaces, and provides contributors writing future T11.x worked examples with a tone-and-structure precedent for the implicit-custody framing.