On November 10, Binance posted a warning on X: an iPhone vulnerability called worse_query could let malicious software installed on your phone rummage through files belonging to other apps. That includes wallet recovery phrases, private keys, and login information.

The vulnerability was disclosed by security researcher forcequitOS, and proof-of-concept code has already been posted to GitHub. Another developer used it to build a tool called WQ Files, which can browse, export, modify, and delete data from other apps without jailbreaking. BleepingComputer tested it and confirmed that it works on affected versions. The versions Binance specifically named are iOS 26.7.1, 27.0.1, and 27.2.

Apple released 27.2.1 and 26.7.3 on November 9, but its security notes didn’t mention this vulnerability. The researcher says it still works on 27.2.1 and the first beta of 27.3. In other words, so far Apple hasn’t confirmed that it’s fixed.

The good news is that this isn’t something an attacker can exploit just by getting you to tap a link or receive a text. They first have to get malicious software installed on your phone. So the risk comes from a very specific source: installing apps from unknown sources, beta or cracked apps, or enterprise-signed installation packages—the kind that ask you to go into Settings and tap “Trust” before they can be installed. The wallet itself hasn’t been breached; what’s been breached is the wall between apps on your phone.

One more thing to be clear about: so far, there’s no confirmed case of anyone losing crypto because of this vulnerability. Binance told Cointelegraph the same thing. Being able to read wallet files doesn’t mean the keys can immediately be used; the level of risk depends on how the wallet stores that data. But waiting until someone actually loses funds to take action would be too late.

Three things you can do tonight. First, go through your phone and delete all apps that weren’t installed from the App Store or that you don’t recognize—especially anything that asked you to trust an enterprise certificate during installation. Second, update both your operating system and wallet apps to the latest versions. Even though the patch hasn’t been confirmed, update anyway. Third, don’t store your recovery phrase in your phone’s Notes app, photo library, or chat history. If you suspect your phone has been compromised, use a clean phone to create a new wallet and move your funds there, then sign out of all active sessions.

The iPhone sandbox has always been one reason people feel comfortable keeping their wallets on their phones. This is a reminder that the wall can be breached—and when it happens, it can go unnoticed.

Do you have any apps on your phone that weren’t installed from the App Store?

#iOS安全 #钱包安全 #防骗 #recoveryphrase

— Web3 Retail Investor Kai

This content reflects only personal opinions and does not constitute investment advice. Please make your own judgment.