Smartphone Sandbox Bug Threatens Crypto Wallet Security

A recently identified operating system vulnerability could allow malicious applications to access sensitive data stored by cryptocurrency wallets on mobile devices.

Known as "worse_query," the security flaw targets the application sandbox on Apple's iOS devices. The sandbox is designed to isolate installed software and prevent unauthorized access to private files belonging to other applications. However, published technical research demonstrates a "sandbox escape" that bypasses these restrictions, according to a security warning issued on November 10.

The published proof of concept affects multiple operating system releases, specifically citing iOS 26.7.1, 27.0.1, and 27.2. The researcher behind the worse_query repository describes it as a developer proof of concept rather than a device jailbreak. By exploiting this flaw, malicious software could reach directories normally restricted to other applications, potentially harvesting locally stored cryptocurrency credentials.

A spokesperson for Binance, which issued the warning based on published technical evidence, noted that actual exposure depends on how individual applications store and encrypt data.

“Seed phrases, private keys and login credentials could be exposed if stored in those files in plaintext or otherwise recoverable form,” the spokesperson said.

Despite the technical exposure, there is currently no evidence of active exploitation targeting digital assets through this method. “At present, we have not identified any confirmed cases in which attackers used worse_query to access cryptocurrency wallets or steal funds,” the representative added.

Device-Level Exposure

Because the vulnerability exists at the operating system level, it threatens a wide array of software rather than any single wallet provider or exchange application.

“This is an iOS-level vulnerability in the isolation between applications, not an issue specific to Binance or a particular wallet provider,” the exchange confirmed.

It remains unclear whether a dedicated security update has been issued. While Apple has released updates for the affected iOS versions, current advisory records do not confirm a specific fix for worse_query. “We do not currently have verified information confirming a security patch or a CVE number for this specific vulnerability,” the Binance representative stated.

To mitigate risks, security teams advise users to delete any applications installed outside official channels, particularly manually signed or unknown sideloaded IPA packages. Users who suspect their device has been compromised are urged to generate a new wallet on a secure device, transfer their holdings, and abandon the old addresses.

Broader Mobile Threats

The worse_query disclosure follows a series of recent warnings regarding mobile device security. In September, users were alerted to FomoPeek versions 1.1 and 1.2, which security firm SlowMist found to contain malicious code designed to bypass standard application permissions on Apple devices.

More recently, on November 6, researchers at CertiK documented a separate security threat involving the updated DarkSword exploit framework. That vulnerability reportedly targets several prominent cryptocurrency applications on vulnerable iPhones, including MetaMask, Trust Wallet, Phantom, Exodus, and Coinbase. Security analysts noted that the DarkSword threat is distinct and does not establish that worse_query has been exploited against those named wallets.