VESPR and Begin Respond to iPhone Security Flaw
VESPR outlined how it protects recovery phrases, while Begin advised iPhone users to update iOS and install apps through the App Store.
By SongMarketCap
Updated:
Binance warned on November 10 that a malicious iPhone app could read certain files belonging to other apps on the same device. For Cardano users, the risk depends on what their wallet stores locally and how it protects that data. VESPR explained how it stores recovery phrases, while Begin issued precautionary advice.
What the iOS flaw could expose
The publicly disclosed flaw, known as worse_query, allows an app to bypass some of the restrictions iOS uses to isolate apps. A recovery phrase or private key could be exposed if a wallet stores it unencrypted in a file a malicious app can read.
Binance named iOS 26.7.1, 27.0.1, and 27.2 in its warning. The researcher who disclosed the flaw reported a broader range of affected versions. A Binance spokesperson said the exchange had identified no cases of the flaw being used to access crypto wallets or steal funds at the time of reporting.
How VESPR and Begin responded
VESPR said it encrypts recovery phrases and stores the decryption key in Apple’s iOS Keychain. According to the wallet team, the flaw cannot reach that key. On that assessment, reading the app’s files would leave the recovery phrase encrypted.
Begin advised users to update iOS and install apps through the App Store. Its public statement focused on precautions and gave no assessment of whether the flaw could expose recovery phrases stored by Begin.
[NEWSBREAK]
What Apple’s updates clarify
Apple released iOS 27.2.1 and 26.7.3 on November 9. Neither set of security notes identifies a fix for worse_query. The researcher who disclosed the flaw reported that it still affects iOS 27.2.1. The wallet teams recommended updating as a precaution.
Wallet encryption covers the copy stored by the wallet. A photograph or note containing the same recovery phrase is a separate copy, with its own exposure depending on how it is stored. When a hardware wallet handles signing, the private keys remain on the signing device while the iPhone can prepare and display the transaction.