iOS vulnerability worse_query: are crypto wallets on the iPhone at risk?

The iOS vulnerability "worse_query" can put crypto wallets on the iPhone at risk, but only under one condition: an app that does not come from the App Store must be running on the device, and the wallet must store its seed phrase or key store unencrypted in its file folder. There are no confirmed thefts so far. Binance and the security firm SlowMist nevertheless issued warnings on Tuesday, because the code has been public since Sunday and Apple has not yet confirmed whether Monday's updates close the gap.

For investors in Germany, this becomes a concrete question of custody. If you hold Bitcoin or Ether in an app on your iPhone, you own a so-called hot wallet: a software wallet whose private key sits on an internet-connected device. Those keys are exactly the target once a foreign app can suddenly look into the folders of other apps. How large the risk is in an individual case depends on three things: the iOS version, where your apps come from and the way your wallet stores its secrets.

What the worse_query sandbox escape opens up on the iPhone

Every app on the iPhone runs in a sandbox. The sandbox is a sealed-off area of the operating system in which an app may only see its own files. This principle is the core of iOS security: a flashlight app cannot get to your photos, and a game cannot reach the data of your banking app.

"worse_query" breaks this separation. The security researcher who goes by the name forcequitOS published the code on GitHub on Sunday and named a second researcher as co-discoverer. According to The Hacker News, the proof of concept, meaning the working demonstration of the flaw, reaches the data containers of all apps on the device, and on iOS 27 some system folders as well. A developer has already used it to build a file manager that can read, change and delete the data of other apps, without a jailbreak and without attacking the system kernel.

The researcher himself writes that the code is not useful on its own and is aimed at developers. He says he published it earlier than planned because Apple responded only hesitantly to his report and others were already boasting about the flaw. SlowMist describes the vulnerability as an escape from the app container and explicitly not as a jailbreak. The difference matters: a jailbreak removes the protection mechanisms of the entire system, while worse_query only opens a view into other apps' folders.

Affected iOS versions: SlowMist and Binance cite different releases

The accounts differ on which devices are affected. Based on the discoverer's documentation, SlowMist lists iOS 26.0 to 26.7.2 as well as iOS 27.2. Binance names iOS 26.7.1, 27.0.1 and 27.2 in its own warning. The exchange is describing the versions listed as tested in the file manager's release notes, while the discoverer himself gives a wider range.

It therefore makes sense to work from the wider range: every iPhone running iOS 26 or iOS 27 up to and including 27.2 should be considered potentially affected. Older devices on iOS 18 do not appear on either list. You can find your version under Settings, General, About, in the iOS Version field.

Do iOS 27.2.1 and iOS 26.7.3 fix the security flaw?

On Monday Apple released iOS 27.2.1, iOS 26.7.3 and iOS 18.7.12. According to Apple's security notes, the updates fix bugs in iMessage and Bluetooth. Neither worse_query nor any sandbox issue is mentioned there. As a rule, Apple does not comment on security vulnerabilities until its investigation is complete and a patch is available. The company had not responded to a request from the trade outlet Cointelegraph by the time its report was published.

Whether the latest update helps is therefore open. You should still install it, because it closes other documented flaws and because any later fix for worse_query will build on this release. An up-to-date system is no proof of protection against this one flaw, but an outdated system is open to more attacks.

A quick note on the status: according to reports so far, there is not yet a CVE entry, the official identification number for a security vulnerability.

When a crypto wallet on the iPhone is genuinely at risk

SlowMist stresses that the flaw alone steals nothing. Several conditions have to come together before a wallet can actually be read out. First, a malicious app that executes the code has to be on your device. Second, this app has to set up a so-called App Group directory, a shared storage area that apps from the same developer normally use together. Third, the wallet has to store its seed phrase or keystore unencrypted in its own folder.

The seed phrase is the list of 12 or 24 words from which all keys of a wallet can be derived. Anyone who knows it can restore the balance on any device in the world and drain it. A keystore is a file that holds the private key, ideally encrypted with a password. Reputable wallet apps store both in encrypted form or use the iPhone's keychain and its secured hardware area. None of the sources has so far confirmed or ruled out whether worse_query can reach the keychain.

Binance has not named any specific wallet app as affected. A spokesperson for the exchange told Cointelegraph that the underlying file access risk could affect the entire iOS ecosystem. There are no known cases in which attackers used this flaw to open crypto wallets or steal funds, the spokesperson added.

Sideloading and alternative app marketplaces carry the main risk

The decisive factor is where your apps come from. Sideloading means installing an app outside Apple's App Store, for example as an IPA file via tools such as AltStore or SideStore, or as a self-signed app using your own Apple ID. These very tools automatically set up the App Group directory that worse_query needs. Nobody has yet answered whether an app from the regular App Store could also use the technique.

In the EU, Apple has allowed alternative app marketplaces since the Digital Markets Act. That widens the choice, but shifts part of the vetting onto you. If you pick up wallet tools, trading bots or airdrop helpers from unofficial sources, you should look at these apps especially critically now. You know the same pattern from browsers: there, too, seemingly harmless add-ons turned out to be wallet thieves that harvested seed phrases.

This is quick to check. Under Settings, General, VPN and Device Management you will find developer profiles used to sign apps outside the store. Any profile you cannot identify should be deleted, together with the apps attached to it.

Hot wallet vs hardware wallet: where the private key is stored

The flaw casts an old principle of crypto custody in a new light. A hot wallet on a smartphone is convenient, but its protection depends on the operating system. If a protective layer such as the sandbox fails, the key may be exposed. A hardware wallet works differently: the device generates and stores the private key on its own chip and never releases it. The smartphone only sends the transaction for signing, and confirmation happens at the press of a button on the device.

Even if a foreign app could read every folder on your iPhone, it would find no key with a hardware wallet. At most it would see public addresses and balances. If you hold larger amounts, the hardware wallet comparison lists devices that connect to the iPhone via Bluetooth or cable. For smaller sums that you trade regularly, a software wallet remains sensible, provided it encrypts its data and requires Face ID or a PIN; the software wallet comparison shows the differences.

A sensible split looks like this: the bulk sits on the hardware wallet, and the iPhone holds only the amount you plan to move in the coming weeks. The seed phrase belongs neither in the Notes app nor in a screenshot or iCloud. How to secure it offline on paper, on steel or split across locations is covered in our guide on how to store your seed phrase safely.

Exchange apps on the iPhone: login data, sessions and two-factor protection

In its warning, Binance explicitly mentions login credentials too. Exchange apps do not store a seed phrase, because the exchange holds the coins. They do, however, store login data and session tokens, the digital passes that keep the app signed in. If such a token falls into the wrong hands, an attacker could in the worst case access your account without knowing your password.

Two layers of protection help here. A withdrawal whitelist only allows withdrawals to addresses you have approved in advance, usually with a waiting period for new entries. Two-factor authentication with a hardware key or an authenticator app on a second device ensures that a withdrawal needs more than the compromised iPhone. If you suspect anything, end all active sessions in the exchange's security settings and change your password. The choice of platform matters as well: exchanges with MiCA authorisation are subject to fixed rules in the EU on IT security and the safekeeping of client funds.

Moving your wallet after a suspicion: a new seed phrase on a clean device

If you installed an app from an outside source in recent weeks and also ran a software wallet on the same iPhone, moving your funds is the safe choice. Binance advises transferring the balance to a new wallet created on a clean device. Clean means a device without apps from outside sources, with an up-to-date system, ideally a hardware wallet.

The order matters. First you set up the new wallet and write down its new seed phrase offline. Then you send a small test amount and confirm that it has arrived. Only after that does the rest follow. Never use the old seed phrase again, not even for a new app, because an attacker may already know it. Our guide to restoring a wallet explains the recovery and the move step by step.

For tokens on Ethereum and other EVM blockchains, it is also worth checking the permissions you have granted, the so-called approvals. These approvals remain attached to the old address and do not affect the new account, but they should be revoked if there is any balance left on the old address.

Why Apple's silence on worse_query makes things harder

Normally a security vulnerability follows a fixed pattern: the researcher reports it confidentially, the vendor develops a patch, and only then does it become public. With worse_query, this order has been turned upside down. The code is freely available, the patch is not confirmed, and anyone with programming skills can build the technique into an app of their own. For the crypto scene that is a delicate situation, because experience shows that attackers react quickly when a tool makes it easier to get at wallets.

The threat to wallets on the iPhone is not new. In March 2026, security researchers described the exploit kits Coruna and DarkSword, which harvested wallet data alongside passwords and messages on older iOS versions. Against that malware, an up-to-date operating system was the main defence. With worse_query that protection is missing for now, because Apple has not confirmed a patch.

At the same time, the hurdle remains high. An attack needs your help, namely the installation of an app from an unsafe source. If you only use apps from the App Store and have not installed any developer profiles, you are significantly less exposed on current knowledge. There is still no reliable answer to whether apps from the store could exploit the flaw as well.

iOS flaw worse_query: until Apple responds, app hygiene is what counts

1. Remove apps from outside sources and update iOS. Delete sideloaded apps and unknown developer profiles, install iOS 27.2.1 or 26.7.3 and update all your apps. Move larger holdings to a device from the hardware wallet comparison.
2. Review your software wallet. Only use wallet apps that store their data encrypted and require a lock via Face ID or PIN. The software wallet comparison shows a selection.
3. Secure your exchange account. End all sessions, change your password, activate the withdrawal whitelist and keep only as much on the exchange as you need for trading. The overview of regulated crypto exchanges shows which providers hold an EU licence.

(As of November 10, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)