On November 9, 2026, both desktop and mobile platforms lit up red almost simultaneously: Google urgently pushed a stable version update for Chrome, fixing 9 vulnerabilities including the zero-day vulnerability CVE-2026-125350 that had already been exploited in the wild; on the other side, Binance reminded users of the iOS 26.7.1, 27.0.1, and 27.2 systems regarding the worse_query vulnerability, where malicious applications could read local files, directly exposing mnemonic phrases, private keys, and login credentials beneath an internal “backdoor window” in the device. The control of blockchain addresses completely depends on private keys; once the terminal is compromised, attackers can initiate transfers on-chain autonomously, making the assets nearly impossible to recover. Meanwhile, crypto users are highly reliant on Chrome and their smartphones to perform operations on web wallets, extension wallets, and mobile wallets, causing browser zero-days and operating system vulnerabilities to merge into a comprehensive attack surface in this round of events. Concurrently emerging with this terminal risk is a new "support beam" on the defense side: Google DeepMind completed formal verification of parts of the widely used Signal protocol using AlphaProof Code in approximately four weeks, and although no new vulnerabilities were found, it demonstrated that AI-driven formal verification could indeed provide stricter security proofs at the protocol level, signaling that future wallet and protocol audits may gradually incorporate such AI tools into their regular defenses while the attack surface continues to expand.
Zero-day Exploited in the Wild: Desktop Browsers Become Weak Links
When the protocol layer begins to use AI for formal verification, attacks find rougher entry points. On November 9, 2026, Google pushed a security update for the stable version of Chrome on desktop, version number Windows/Mac 157.0.8103.50/.51, Linux 157.0.8103.50, disclosing that it fixed 9 security vulnerabilities, of which 7 were rated as high-risk and 2 as medium-risk, focusing on core components such as V8, WebGL, GPU, XML, and FileSystem. For a large number of crypto users dependent on Chrome for web wallets, extension wallets, and transaction operations, these components are crucial for loading pages, executing scripts, and reading/writing local data; once compromised here, the browser transitions from an “interface” to a springboard for attackers directly accessing private keys and login credentials.
The real risk that has taken center stage is the high-risk vulnerability CVE-2026-125350 in the XML component—it was marked as a zero-day vulnerability, and Google has confirmed it is being exploited in the wild. This means that before the patch was released, attackers had already mastered a means of exploitation, giving them the opportunity to launch targeted attacks on terminals through this browser entry without the user being aware. Google has urged users through official channels to upgrade to the latest version as soon as possible, but in reality, there often exists a time lag between the pace of browser updates and the actual upgrades by users. During this window of opportunity, where a patch is available but not yet fully deployed on the user side, the desktop browser has ironically become the most prominent and easily underestimated weak link in the current crypto security chain.
iOS System Vulnerability Points to Private Key Security
If the desktop zero-day has made the browser a noticeable gap, the issues hidden in the pocket on the mobile side are even more subtle. In the simultaneous security alerts issued by Binance, worse_query was explicitly defined as a system vulnerability for iOS versions 26.7.1, 27.0.1, and 27.2, emphasizing that the risk comes from the operating system itself, rather than from a broken code in some trading or wallet application. In other words, as long as a user operates above these system versions, even if they have never installed the Binance app, they remain within the same underlying risk.
According to Binance, worse_query allows malicious applications to read local files, and if users have stored mnemonic phrase screenshots, plain-text private key backups, or auto-filled login credentials on this device, these sensitive data, which were originally believed to be "local only", could quietly be copied in the background. Considering that control over blockchain addresses completely depends on private key possession, once a private key is leaked, attackers can directly initiate transfers on-chain, and assets are typically difficult to recover. Therefore, the countermeasures suggested by Binance seem particularly aggressive: the first step is to upgrade to the latest iOS version and delete dubious applications; if a device is suspected of being compromised, a new wallet should immediately be created on a completely new, trustworthy device, transferring all funds there and resetting all active sessions, because for users who manage assets on their phones, this invisible, system-level crack has directly pointed to the lifeline of the private key itself.
One Phone, One Browser: How Wide is the Attack Surface for Crypto Users
For most crypto users, the asset world is connected to reality through just two doors: a browser on their computer and the smartphone in their pocket. The former is the main venue for accessing web wallets and decentralized applications, with many people accustomed to opening DApps in Chrome and using browser extensions to sign each transaction; the latter hosts mobile wallets, with mnemonic phrases and private keys encrypted and stored locally, completely relying on operating systems like iOS to isolate them from other applications via permission separation. On the surface, users are interacting with various applications, but what truly determines life and death is the invisible foundation of the browser and operating system.
This round of simultaneous exposure of desktop Chrome zero-day vulnerabilities and iOS worse_query system vulnerabilities has struck at these two foundational layers. The former points to the browser entry often used for connecting to DeFi and web wallets, while the latter allows malicious applications to read local files, potentially turning mnemonic phrases, private keys, and login credentials that should be sealed within the system's encrypted areas into open pages. The control over blockchain addresses completely depends on who possesses the private key. Once the terminal environment is breached and the private key falls into the hands of others, attackers can freely initiate transfers on-chain, and assets are typically difficult to recover. This irreversible consequence far exceeds the level of "an account being hacked", resembling more the erasure of the entire identity and asset sovereignty in reality.
DeepMind Enters the Security Battle
Once the terminal is compromised and the private key becomes public, all that the defense side can do is minimize errors at the "design stage". Google DeepMind's introduction of AlphaProof Code into the battlefield is about pushing AI to the forefront of protocol design: reports state that they completed partial formal verification of the Signal protocol using AlphaProof Code in about four weeks. The approach to formal verification is not to "run it and see if it has errors," but rather to rigorously depict the security properties that the protocol should possess under various inputs and states using formal specifications, and then let an automated proof system check whether these properties can be logically derived across all possible paths.
According to disclosures from WIRED and other sources, in the portions of the Signal protocol examined, AlphaProof Code did not uncover new vulnerabilities, but it could identify known old vulnerabilities within the older protocol and conclude that it "cannot pass formal verification"—this is more like a demonstration of methodology: it proves that the combination of AI and formal verification does indeed have the capacity to mathematically disprove unsafe designs, but there is still a long way to go before achieving "one-click proof of complete security for complex encryption systems." The Signal protocol itself is a widely used end-to-end encrypted communication protocol, and its selection as a subject is representative. The verification results provide a reference framework for future similar encrypted communication solutions, as well as for wallets and asset protocols involving address control and transaction rules. Whether this framework can extend to more complex protocol stacks will determine whether AI formal verification in the crypto world is a fleeting demonstration or can truly become the infrastructure against zero-day vulnerabilities over the long term.
The Long-term Security Battle: How Should Crypto Users Respond
This round of events affecting desktop browsers, mobile systems, and encrypted communication protocols has pulled crypto users back to a harsh reality: attackers and defenders are no longer engaged in close combat on a single battlefield, but are stretching across terminals, systems, and protocol stacks. On the desktop front, Google pushed an urgent update for Chrome on November 9, 2026, version 157.0.8103.50/.51, which fixes 9 vulnerabilities including the zero-day CVE-2026-125350; on the mobile front, there is the iOS worse_query vulnerability singled out by Binance, where the risk comes from the operating system itself and could allow malicious applications to read local files containing mnemonic phrases and private keys; at the protocol level, Google DeepMind, using AlphaProof Code, completed the formal verification of parts of the Signal protocol in about four weeks, demonstrating that AI can provide binding security conclusions on complex protocols. For holders of cryptocurrency, control over blockchain addresses ultimately locks on that string of private keys. Once leaked, it is almost impossible to recover transferred assets on-chain. In a stage where defensive tools and AI auditing capabilities are still evolving, treating browsers and phones as "cold, hard tools" rather than security boundaries will have exceptionally high costs—promptly following upgrade suggestions from vendors like Google and Binance, cleaning up suspicious applications should be regarded as the foundation of the entire asset security system, not as optional patches. As for the AI formal verification capability demonstrated by AlphaProof Code, whether it can truly penetrate into core infrastructures involving private keys and funding paths, such as wallets and cross-chain bridges, will determine whether the long tug-of-war around zero-days and system vulnerabilities continues to be borne by individuals with their bodies or can gradually be passed on to stronger protocols and tools.
Join our community, let's discuss and become stronger together!
AiCoin exclusive Hyperliquid benefits: https://app.hyperliquid.xyz/join/AICOIN88
AiCoin exclusive Aster benefits: https://www.asterdex.com/zh-CN/referral/9C50e2
On-chain Telegram community: https://t.me/AiCoinWhaleData
On-chain community: https://www.aicoin.com/link/chat?cid=N6OVMor5g
AiCoin on-chain Twitter: https://x.com/aicoinwhaledata
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。
