A public iOS sandbox-escape project called worse_query has renewed questions about the safety of storing crypto credentials on iPhones. Its GitHub page describes a sandbox escape affecting iOS 26.0–26.7.2 and iOS 27.2, but labels the code a developer proof of concept that is not useful by itself. It is not evidence of a live wallet-draining campaign.

The project nonetheless arrives amid a string of security investigations published during 2026 that exposed fake wallet apps, recovery-phrase theft, and sophisticated iOS exploits. Together, these cases point to a central risk: attackers can target the information and devices that control crypto, rather than the blockchain itself. Ten lessons stand out.

1. Separate Proof of Concept From Confirmed Attacks

On GitHub, worse_query describes a sandbox escape for iOS 26.0 through 26.7.2 and iOS 27.2. A sandbox escape breaks code out of the isolated environment iOS uses to keep apps separated from one another's data and from system resources. Its author says the code is intended for developers, is not useful by itself, and is not a jailbreak. Publication therefore does not prove criminals are using it to steal wallet credentials. Treat such code as a reason to follow security advisories, not to panic or install exploit tools. Keep the iPhone updated and avoid untrusted developer utilities.

2. Install Security Updates Promptly

Apple's September 28, 2026, notice for iOS 26.7.1 addressed a CoreGraphics flaw that could allow arbitrary code execution — attacker-chosen code running on the device — when processing a malicious file. Apple said it was aware of a report that the issue may have been exploited against specific targeted individuals before iOS 27, but did not identify a crypto campaign or wallet theft. Even so, a compromised phone may expose wallet apps, email, and authentication codes. Install the latest iOS version available for the device, enable automatic updates, and avoid unexpected files or links.

3. Keep Recovery Phrases Out of Photos

Kaspersky's April 2026 SparkCat report found a variant hidden in legitimate-looking apps whose iOS version scans photo galleries for English-language wallet mnemonic phrases. Researchers found two infected apps in Apple's App Store and one in Google Play; the malicious code was later removed.

A recovery phrase is the master key to a wallet: anyone who obtains it can restore the wallet on another device and spend its funds. Never photograph, screenshot, or store recovery words in photos, cloud galleries, or message attachments. If a phrase may have been accessed by an untrusted app, treat it as exposed: create a new wallet in a trusted environment and transfer the funds.

4. Verify the Publisher Behind Every Wallet App

Kaspersky identified 26 fraudulent App Store applications impersonating MetaMask, Ledger, Trust Wallet, Coinbase, and other wallets. Their icons and names copied legitimate products, and some initially offered unrelated features such as calculators or games. The campaign mainly appeared in the Chinese App Store, where certain official wallets were unavailable.

An App Store listing is not proof of authenticity. Visit the wallet provider's official website independently and follow its direct store link. Check the developer name and spelling before downloading, and never rely on search ranking or a familiar logo.

5. Refuse Unknown Profiles and Seed-Phrase Prompts

Kaspersky's FakeWallet technical report explains how counterfeit listings redirected users to imitation App Store pages and urged them to install developer profiles. Those profiles enabled trojanized wallet apps to be installed outside the normal store process, and the malware could intercept wallet recovery and creation screens to capture users' recovery phrases, potentially giving attackers access to their funds. Such profiles are Apple's mechanism for installing apps outside the App Store, intended for app development and enterprise distribution rather than consumer installs. The two Kaspersky reports describe the same broader campaign from different angles, not two unrelated outbreaks.

Never install a profile or enterprise certificate to obtain a wallet, and reject any "security check" asking for a recovery phrase.

6. Keep Sensitive Data Out of Notes and QR Images

Google's March 2026 Coruna investigation identified five iOS exploit chains containing 23 exploits. Its financial payload could decode QR codes in images and search Apple Memos for BIP39 word sequences — the standardized word-list format most wallets use to encode recovery phrases — or phrases such as "backup phrase." It also targeted information from numerous crypto wallet apps.

Do not store seed phrases, private keys, or backup QR codes in Notes or image folders; keep recovery material offline in a secure physical location. Google said Coruna did not work against the latest iOS version and advised updating, or enabling Lockdown Mode if an update was not possible.

7. Protect the Whole Phone, Not Only the Wallet

Google's March 18 DarkSword report described an iOS exploit chain using six vulnerabilities against devices running iOS 18.4–18.7. The malware could collect cryptocurrency wallet data, messages, contacts, photos, files, and browsing history, and Google identified campaigns targeting users in Saudi Arabia, Turkey, Malaysia, and Ukraine. According to Google, the vulnerabilities were patched by iOS 26.3, with most fixed earlier.

A compromised phone can expose more than one wallet. Update iOS, avoid suspicious websites, and consider Lockdown Mode — Apple's optional maximum-security setting designed for people facing targeted attacks — when elevated targeting risks apply.

8. Do Not Treat an Old iPhone as Cold Storage

OneKey founder Yishi Wang warned against keeping recovery phrases on older iPhones, even when devices are wiped or disconnected. A November 1 report discussed hardware-level vulnerabilities affecting older models, while noting that exploitation requires physical access and specialized equipment, and that the flaws do not automatically reveal every stored seed phrase.

Airplane mode does not turn a phone into a hardware wallet. Avoid using an old iPhone as the sole vault for recovery words. If a seed may be exposed, generate a fresh one in a trusted environment and move the assets.

9. Verify Transactions on a Separate Hardware Screen

A July 2026 report quoted Trezor's chief commercial officer defending hardware wallets as a strong self-custody option for most users. He pointed to the separate screen, which lets users check transaction details before signing, while noting that high-value holders may need layered arrangements.

Hardware wallets are not invulnerable. Buy through trusted channels, verify the full address and amount on the device screen, protect the recovery backup, and keep firmware current. Separate long-term holdings from everyday spending where practical.

10. Check the Full Address Before Sending Funds

Microsoft's June 2026 investigation examined a Windows-based crypto clipper that monitored clipboard data, stole seed phrases and private keys, and replaced copied wallet addresses. It also spread through infected USB shortcuts and used Tor for command-and-control. The campaign was not iPhone malware, but it exposes a transfer risk that spans connected devices.

Before sending, compare the complete destination address with trusted recipient details and do not rely only on the first and last characters. For large transfers, send a small test amount and confirm receipt first.

The Common Threads

Across the cases, three weaknesses recur: exposed recovery phrases, deceptive downloads, and unchecked transactions. iPhone security requires more than an app password. Keep software current, verify wallet sources, store backups offline, and confirm transactions on a trusted screen. Because self-custody provides no support desk to reverse a mistaken transfer or regenerate a lost phrase, these habits effectively are the account security. No single setting or device replaces these habits.

Frequently Asked Questions

Is the worse_query project evidence of an active wallet-theft campaign?

No. Its GitHub documentation describes it as a developer proof of concept that is not useful by itself, and its publication does not establish an active wallet-theft campaign.

Can iOS apps really scan photo libraries for recovery phrases?

Yes. Kaspersky identified a SparkCat variant that scans photo galleries for wallet mnemonic phrases. Avoid saving seed phrases in screenshots, photographs, or cloud-synced images.

Are App Store wallet apps always genuine?

No. Kaspersky identified 26 fraudulent listings impersonating established wallet brands. Verify the publisher through the wallet provider's official website before installing an app.

Is an old, disconnected iPhone safe for storing seed phrases?

No. Disconnecting a device does not eliminate hardware vulnerabilities or physical-access risks. An old phone should not be the only place holding recovery credentials.

What should I do if my recovery phrase may have been exposed?

Treat the phrase as compromised. Create a new wallet with a fresh recovery phrase in a trusted environment, then transfer funds to its addresses. Never reuse the exposed phrase.