Your Crypto Wallet Keys Are Sitting in Plaintext: SlowMist Flags iOS Exploit Targeting Millions
Security firm SlowMist has flagged an active iOS sandbox escape vulnerability that could hand attackers direct access to the private keys and seed phrases sitting unencrypted on your phone right now.
The warning centers on the `worse_query` repository, a publicly documented exploit chain listing iOS versions 26.0 through 26.7.2 and 27.2 as confirmed targets. That is not a narrow slice of users. Those version ranges cover a massive portion of active iPhones in circulation today, and the attack surface is exactly where crypto holders are most exposed: local device storage.
What the Exploit Actually Does
A sandbox escape on iOS means an attacker breaks the isolation barrier Apple builds between apps. Under normal conditions, one app cannot read another app's data. A successful sandbox escape tears that wall down.
The specific danger SlowMist is shouting about is that many wallet apps, including some widely used ones, store sensitive data in plaintext locally. No encryption. No additional protection layer. Just a string of words that unlocks your entire net worth, sitting in a file that a sandbox escape can now reach.
This is not theoretical. The repository naming specific iOS versions suggests active research and likely active exploitation. SlowMist does not wave red flags without receipts.
Why This Hits Different Than a Typical Hack
Most crypto exploits target protocols, bridges, or smart contracts. This one targets the device in your pocket. It does not matter how airtight your DeFi strategy is or how carefully you vet contracts. If your seed phrase is stored in plaintext on a vulnerable iPhone, the protocol layer is irrelevant.
The wallets most at risk are software wallets that treat local storage as a convenience feature rather than a liability. Hot wallets used daily for trading, DeFi interactions, or NFT minting are prime targets precisely because users need quick access and developers sometimes sacrifice storage security to deliver it.
What You Should Do Right Now
First, check your iOS version. If you are running any build between 26.0 and 26.7.2 or on 27.2, treat your device as compromised until Apple patches this.
Second, move meaningful holdings off any software wallet stored on your iPhone immediately. Hardware wallets exist for exactly this scenario.
Third, do not wait for a patch announcement to act. The gap between public vulnerability disclosure and Apple's response window is precisely when attackers move fastest.
Watch SlowMist's official channels for updated wallet-specific guidance. If a patch drops, update the same day. This one is not worth sitting on.