iPhone worse_query flaw: Binance warns crypto seed phrases at risk

What is the worse_query flaw?

On an iPhone, each app runs in its own sandbox, an isolated space that stops it from poking around in other apps' data. worse_query gets around that wall. Two researchers, @0xjohnny and @forcequitOS, found it and published a demonstration on GitHub. According to the report, it can be used to steal confidential data or delete an app's information.

Is my iPhone wallet at risk?

Probably less than the headlines suggest. An attacker still has to get a malicious app onto your phone, for instance by convincing you to install one from an untrustworthy source, Bitdefender explains. So people who sideload apps from outside the App Store are most exposed. Bitdefender also notes that not every wallet is automatically exposed: it depends on how each app stores and protects its sensitive data.

Ledger's chief technology officer, Charles Guillemet, takes a blunter view. Flaws like this used to be expensive and reserved for well-funded attackers, he says, but their cost is heading toward zero and they are now exploited at scale. His advice: don't keep anything valuable on your phone, least of all crypto seed phrases.

Apple recently shipped iOS 27.2.1, but neither it nor the first beta of iOS 27.3 fixes the bug. No crypto theft using it has been reported so far.

Until a patch arrives, Binance suggests deleting any app installed from unofficial sources. If you suspect a break-in, move your funds to a new wallet, created on a clean device if needed, and log out of all active sessions. And don't keep your recovery phrase in a screenshot or a phone note.