Binance Warns of iOS 'worse_query' Flaw That Could Expose Wallet Keys on iPhone
Binance warned iPhone users that an iOS sandbox escape known as worse_query could let malicious apps read other apps' files, potentially exposing seed phrases and private keys. Binance said it has identified no confirmed cases of crypto theft, and users are advised to remove untrusted apps and install official updates.
Written by CoinArticle’s AI Newsroom · from 3 cited sources. How we work
Story Updates
- Updated Nov 10, 2026, 12:49 PM: Binance confirmed no known thefts and noted iOS 26.7.3 shipped alongside 27.2.1, with the exposure scope tied to each app's storage.
The Warning and Affected Versions
Binance warned iPhone users on Tuesday, November 10, about a vulnerability in Apple's iOS that it says could allow malicious applications to read files belonging to other apps. The exchange named the flaw "worse_query" and listed iOS 26.7.1, 27.0.1 and 27.2 as affected versions. According to the warning, the exposure could include seed phrases, private keys and login credentials stored locally. The advisory covers both iPhones and iPads.
Binance stressed that the issue sits at the operating-system level rather than within its own products. In a statement to crypto.news, a Binance spokesperson said the warning was based on published technical evidence and that the exchange's iOS app and other applications on vulnerable devices could be affected in the same way, depending on how each app stores and encrypts its data. The advisory was endorsed by Binance co-founder Yi He and by Charles Guillemet.
What the Flaw Does and How It Surfaced
The vulnerability is a sandbox escape. iOS normally isolates each app so it cannot read another app's private files, and worse_query reportedly bypasses that isolation. The proof of concept was disclosed on November 8 by a researcher who goes by forcequitOS, who credits the discovery to another researcher identified as 0xjohnny. The author describes it as a developer demonstration that is not a jailbreak and "isn't useful by itself." The repository calls it the "direct successor" to an earlier exploit, bad_query, and says it can reach the folder where iOS apps store their data.
Coverage differs on how many releases the proof of concept reaches. Crypto.news reports it covers multiple iOS 26 and 27 releases, while Decrypt cites the repository as covering iOS 26.0 through 26.7.2 and iOS 27.2. Both agree on the core claim that a malicious app could reach other apps' files.
Exposure Is Conditional
The scope of actual risk is narrower than the headline warning. Binance told crypto.news that it has not identified any confirmed case in which attackers used worse_query to access cryptocurrency wallets or steal funds. The spokesperson also said exposure depends on whether a wallet stores recovery phrases or keys in plaintext or in a recoverable form, which varies by application. The existence of the flaw does not establish that every wallet keeps keys in such a form.
Binance's guidance reflects that conditionality. It urged users to delete apps from untrusted sources, including sideloaded or manually signed app files, because the attack requires a malicious app on the device. It also urged users to install iOS and app updates only through official channels, and, if they suspect their device may have been compromised, to move funds to a new wallet with a freshly generated seed phrase.
Apple's Response Remains Unconfirmed
Apple released iOS 27.2.1 on Monday, November 9, one day after the proof of concept was published, and also shipped iOS 26.7.3. Its security notes list nine fixes, including an App Intents authorization issue that could let an app access sensitive user data. Neither the notes nor Apple's statements explicitly mention worse_query or confirm that it has been fixed.
Decrypt reports that 23pds, chief information security officer at blockchain security firm SlowMist, believes the update blocks the worse_query sandbox escape and urged users to install it. Apple has not publicly confirmed that the update addresses this specific flaw, so that assessment rests on a single security professional's reading of the release.
Context
The warning follows earlier iPhone-related threats to crypto users. Binance warned in September about FomoPeek versions 1.1 and 1.2, which SlowMist found contained exploit methods for elevated access, and this is not the exchange's first iOS-related alert in 2026. Google previously warned of iOS malware targeting crypto apps on unpatched devices, and in August the Dutch national cyber agency reported attackers exploiting a macOS Screen Sharing flaw to install Monero miners.
Why It Matters
For Traders
No confirmed theft has been tied to worse_query, so near-term price effects are unlikely, but users may move funds, which can create short-lived exchange flow noise.
For Investors
Recurring device-level exploits highlight that custody risk extends beyond exchanges to the consumer OS, a factor in evaluating self-custody exposure.
For Builders
Wallet apps should assume sandbox isolation can fail and review how keys and seed material are stored, encrypted, and protected at rest on iOS.
This article is for information only and is not financial advice. Read the full disclaimer.
