Critical iOS Flaw Exposes Crypto Wallet Keys on Unpatched iPhones
Written by AI from the linked story. Not reviewed by an editor. How this works
A critical iOS vulnerability dubbed 'worse_query' allows malicious applications to read sensitive data — including cryptocurrency seed phrases, private keys, and login credentials — belonging to other apps on the same device. The flaw affects multiple iOS versions and can be exploited via untrusted IPA packages, meaning users who sideload apps from unofficial sources face the greatest risk. This matters enormously in the crypto space because exposed private keys or seed phrases result in irreversible financial loss with no recourse. The incident highlights how unpatched mobile operating systems combined with low security awareness around app sourcing create a dangerous attack surface for high-value digital assets.
Tactical Insight
Immediate actions
- Update all iOS devices to the latest patched version as soon as Apple releases the fix addressing 'worse_query'.
- Avoid installing apps from untrusted IPA packages or unofficial sources outside the Apple App Store until the vulnerability is fully patched.
- Move cryptocurrency private keys and seed phrases to hardware wallets or air-gapped devices that are not exposed to the vulnerable OS.
Long-term improvements
- Establish a mobile device patch management policy that mandates OS updates within 72 hours of a critical security patch release.
- Implement Mobile Device Management (MDM) solutions to enforce and audit patch compliance across all organisational and personal devices handling sensitive assets.
- Train users regularly on the risks of sideloading apps and social engineering tactics that deliver malicious IPA files.
Detection measures
- Deploy endpoint detection tools capable of monitoring inter-process data access anomalies on mobile devices.
- Monitor for unusual app permission requests or sandbox escape behaviours using mobile threat defence (MTD) solutions.
- Set up alerts for any new app installations outside of approved channels on devices enrolled in MDM.