Ledger CTO warns iPhone users to keep crypto seeds off mobile

Ledger CTO Charles Guillemet warned on X that crypto seeds stored on iPhones face risk after Binance flagged a flaw affecting three iOS versions.

Binance named the vulnerability “worse_query.” It can allow malicious applications to access files belonging to other apps on the same device.

Guillemet’s warning came in response to Binance’s urgent security alert. His advice was direct: “Simply don’t store any valuable in your mobile. Especially not your crypto seeds.” He also said vulnerabilities that leak important data are becoming more accessible to attackers.

“Unfortunately this kind of vulnerability used to be very expensive and reserved to high potential attackers,” he wrote. He said those costs are nearing zero. That would make large-scale exploitation easier for cybercriminals.

What does this change for iPhone users?

Binance identifies the affected releases as:

• iOS 26.7.1
• iOS 27.0.1
• iOS 27.2

The vulnerability can expose local files created by other applications. Recovery phrases, private keys and login credentials may therefore be at risk if users stored them in accessible files. Binance said the concern extends beyond its own app and can affect the entire crypto space.

Apple published new security updates on Nov. 9. It remains unclear whether those updates fully close the vulnerability. No confirmed crypto thefts specifically linked to the exploit have emerged.

For users, Binance recommends:

• Uninstalling apps downloaded from untrusted sources.
• Updating the operating system.
• Avoiding unauthorized software.
• Transferring funds to newly created wallets on clean devices if a wallet may be compromised.

The practical change is stricter device hygiene. A phone should not be treated as a dependable vault for wallet secrets. The risk also reaches beyond Binance, so exchange users and self-custody users face the same underlying file-exposure problem.

Why this could spread

Guillemet’s concern is not the patch alone. He said attackers are gaining easier access to vulnerabilities that can leak important data. His warning focuses on falling exploitation costs, which could turn targeted attacks into a mass-market security problem for mobile wallets and exchanges alike.

Lower barriers to exploitation would let cybercriminals reuse the same technique against many devices, shifting the burden toward operating-system updates, careful app installation and separate hardware for recovery.

A separate breach inside Ledger’s supply chain

Guillemet’s warning came a month after Ledger’s October security incident. The French cryptocurrency hardware-wallet maker admitted that hackers had tampered with some devices distributed by its Southeast Asian reseller, CryptoBilis.

Hackers installed complex hardware implants in legitimate Ledger devices. During first-time wallet setup, the implants could capture the 24-word recovery phrase shown on the device screen. Ledger’s investigation found that the implants could send those phrases to attackers over a cellular connection.

Blockchain sleuths estimated that the incident might have caused more than $86 million in crypto losses. Ledger did not confirm the total. That estimate concerns the separate hardware-wallet incident, not the iOS exploit.

The cases expose different operational failures. The iOS flaw reaches data through software on a shared device. The Ledger case involved physical tampering along the supply chain. Neither case leaves a recovery phrase’s security tied to the brand of the app or device displaying it.

The next checkpoint is whether Apple’s Nov. 9 security updates fully close the flaw across the three affected versions, and users who suspect exposure should follow Binance’s clean-device guidance now.