Unpatched iOS Flaw Puts Your Crypto Wallets at Risk

A new, unpatched iOS vulnerability lets malicious apps read other apps' data, putting crypto keys and login credentials at risk.

A security researcher has publicly disclosed a significant, unpatched vulnerability affecting iPhones running iOS 16 and 17. According to The Hacker News, the exploit, dubbed “worse_query,” allows a malicious application to bypass a core security feature and read files stored by other apps on the same device. The public release of the code on GitHub prompted a warning from the cryptocurrency exchange Binance, which highlighted the critical risk to users’ digital assets. The flaw could allow an attacker to steal sensitive information such as crypto wallet seed phrases, private keys, and login credentials directly from an infected device. Notably, Apple’s most recent software updates, released just after the exploit was published, do not include a patch for this specific issue, leaving users exposed.

The vulnerability is what is known as a sandbox escape. On iOS, every application runs in a restricted environment called a sandbox, which is designed to prevent it from accessing data belonging to the system or other apps. This isolation is a cornerstone of Apple's mobile security model, ensuring that even if one app is compromised, the damage is contained. The “worse_query” exploit effectively breaks down the walls of this digital container. By exploiting the flaw, a malicious app can reach outside its designated storage area and read the private files of any other app installed on the phone. This means that data a user believes is protected within a trusted banking or wallet app could be secretly siphoned off by a seemingly harmless utility or game.

This incident highlights the ongoing tension between Apple's curated “walled garden” ecosystem and the security research community. While Apple invests heavily in securing its platforms, determined researchers continually find new weaknesses. The public disclosure of an unpatched, or “zero-day,” vulnerability is a controversial tactic. It creates immediate risk for users but also applies immense pressure on the vendor—in this case, Apple—to develop and release a fix urgently. Unlike highly targeted spyware that exploits similar flaws, the public nature of this code means a wider range of attackers could potentially incorporate it into malicious apps. It serves as a stark reminder that no platform is immune to critical security failures, and the trust placed in the App Store's vetting process is not an absolute guarantee of safety.

For developers, security teams, and CTOs, the immediate takeaway is the reinforcement of a zero-trust mindset, even on seemingly secure mobile platforms. The primary defense against this specific threat is user caution. Employees should be strongly advised against installing applications from unknown developers or outside of the official App Store. Mobile Device Management (MDM) solutions can help enforce policies that restrict app installations on corporate-owned devices. The entire industry will now be watching for an emergency security update from Apple to address the vulnerability. Until that patch is released and deployed, the risk remains active. Developers of applications handling sensitive data should review their security postures, though protection against a system-level exploit is inherently limited and ultimately depends on the platform vendor to resolve.

This vulnerability breaks a fundamental iOS security promise: app isolation. For developers and security teams, it means a malicious app could bypass sandboxing to access sensitive data stored by legitimate apps, including API keys, user tokens, and private credentials stored on the device.

This unpatched flaw creates a significant security liability for any company with an iOS app that handles sensitive customer or corporate data. It increases the risk of data breaches originating from employee devices, potentially leading to financial loss, reputational damage, and regulatory scrutiny if exploited.