What the researcher published
The worse_query repository describes a proof of concept for iOS 26.0-26.7.2 and 27.2. Its author, forcequitOS, says an app configured with an App Group container can access other apps' data directories and shared group containers. The author explicitly calls it a developer PoC, not a ready-made attack tool. The version range in the README is the researcher's claim, not an official Apple affected-version list.
The normal iOS security model isolates third-party apps: each has its own files and should not freely read a neighbor's data. A possible crossing of that boundary therefore matters for wallets. Yet reaching a directory is not the same as obtaining a seed phrase. The outcome depends on whether a particular wallet keeps the secret on the device, where it stores it and how it protects it.
The conditional wallet risk
If a wallet stores its recovery phrase, private key or other sensitive data in a reachable local file without sufficient protection, an app with unintended access to its container could try to read it. That conditional scenario underlies the warnings from Binance and SlowMist. The public PoC does not prove that every iPhone wallet stores secrets this way or that users have already lost funds through worse_query.
This is a question about device isolation and secret handling, not a flaw in Bitcoin transactions or another blockchain. A hardware wallet whose key is not exported to the phone's file system has a different protection boundary. The connected phone still warrants care when installing apps and approving transactions.
What Apple's updates establish
Apple released iOS 27.2.1 and 26.7.3 on November 9. Their published security notes do not name worse_query or directly confirm that this PoC no longer works. The 27.2.1 advisory includes fixes involving apps' access to sensitive data, but that generic impact statement cannot be tied to this particular research project without further evidence.
Installing the latest official iOS release remains sensible because it addresses the issues Apple lists. It should not be described as a verified fix for worse_query until the vendor or an independent technical check establishes that separately. The patch status may change as further information is published.
Steps for wallet holders
Review installed apps and remove software obtained from untrusted sources, then update iOS and apps through official channels. Do not type a seed phrase into a link attached to an alert or give it to someone claiming to be support; warnings can themselves become phishing bait. Keep recovery material off the phone in a secure manner appropriate to the wallet.
If there is a concrete reason to believe a secret was exposed, deleting the suspicious app alone is insufficient. Create a new wallet with a fresh recovery phrase on a clean device and transfer assets after carefully verifying the destination. That is a response to plausible compromise, not a blanket instruction for every iPhone user to move funds immediately.
