Ledger CTO Warns iPhone Users: Keep Crypto Seeds Off Your Phone

Ledger's chief technology officer, Charles Guillemet, took to X on November 10, 2026, with a blunt instruction for anyone holding digital assets: get your recovery phrases off your iPhone. His warning followed a security alert from Binance about a vulnerability in Apple's iOS. According to Guillemet, flaws that pull confidential data out of a device used to cost attackers dearly and were reserved for high-value targets. That price is collapsing, he said, and the techniques are now being exploited at scale.

The flaw Binance flagged carries the name worse_query. It could give malicious applications a path to files belonging to other apps on the same phone, and the exchange says it hits specific versions of Apple's mobile operating system. Because private keys, login credentials and wallet recovery phrases typically sit in local files, they are exactly the kind of data at risk. Guillemet's post was short and direct: do not store anything valuable on your mobile device, and above all not your crypto recovery phrases.

Exchanges responding to the technical incident are pushing a familiar checklist. Users are told to delete apps that came from unverified sources, update their operating systems right away and block installs of unauthorized software. Anyone who suspects their device has been compromised is advised to move funds into new wallets set up on clean hardware.

Apple shipped security updates at the beginning of November, though industry reports say the patch's full coverage against the reported attack vector is still being assessed. So far, no consulted source has confirmed large-scale crypto thefts tied directly to this exploit. Ledger's warning lands alongside other recent security trouble in the sector, including earlier incidents involving the physical device supply chain in the Asian market. The hardware wallet maker keeps telling users the same thing: park long-term private keys on a dedicated device that never touches the internet.