u.today
Ledger Chief Technology Officer Charles Guillemet has recently warned cryptocurrency holders not to store critical wallet information on their iPhones, as the security threat is on the rise.
In his recent post on X, the Ledger executive highlighted the fact that vulnerabilities that can leak important data are now becoming more and more accessible for hackers to exploit.
"Unfortunately this kind of vulnerability used to be very expensive and reserved to high potential attackers," Guillemet tweeted.
However, he pointed out that we're now on the verge of seeing the costs of such vulnerabilities go down to zero, meaning that it could become very easy for cybercriminals to exploit them on a massive scale.
"Simply don't store any valuable in your mobile. Especially not your crypto seeds," the Ledger CTO cautioned.
His words came in response to an urgent security alert published by crypto exchange Binance over a vulnerability that was found in Apple's iOS operating system.
In particular, cryptocurrency exchange Binance reported a vulnerability, dubbed worse_query, which can allow malicious applications to gain access to files of other applications installed on the same device.
As specified by the exchange, this security flaw affects iOS 26.7.1, 27.0.1 and 27.2.
This means that crypto wallet recovery phrases, private keys and login credentials can be at risk, as they may be stored in accessible local files.
Binance underscored that this concern isn't exclusive to the exchange's app alone, while adding that the vulnerability can have an impact on the entire crypto space.
The exchange recommended that users uninstall apps that were downloaded from untrusted sources, update their operating systems and avoid installing any unauthorized software.
Binance also advised users to transfer their funds to newly created wallets on clean devices if they think their wallets may have been compromised.
Apple published new security updates on Nov. 9. However, it's not clear if they are enough to fully patch this vulnerability. Still, there have been no confirmed crypto thefts specifically linked to the exploit.
Ledger's security incident
Guillemet's warning comes a month after Ledger's major security incident involving compromised hardware wallets.
Back in October, French cryptocurrency hardware wallet maker Ledger admitted that some hardware wallets distributed by its Southeast Asian reseller CryptoBilis had been tampered with.
It turned out that hackers managed to install complex hardware implants in legitimate Ledger devices. With that, hackers were able to intercept users' recovery phrases when people were setting up their Ledger wallets for the first time.
As shown by Ledger's investigation, malicious implants were capable of capturing the 24-word recovery phrase that appears on the Ledger device screen and then passing it to attackers via a cellular connection.
Blockchain sleuths estimated that this incident might have led to more than $86 million in crypto losses. However, Ledger itself didn't confirm the total amount.
