Binance warns iPhone users of iOS bug that could expose crypto wallet keys

Binance has warned iPhone users about an iOS vulnerability known as “worse_query” that could allow malicious applications to access files belonging to other apps, potentially exposing cryptocurrency wallet credentials.

Summary

• Binance warns that worse_query could allow malicious applications to access files belonging to other iOS apps.
• The exchange identified iOS 26.7.1, 27.0.1 and 27.2 among versions affected by the vulnerability.
• Cryptocurrency recovery phrases and private keys could face exposure if applications store them in accessible files.
• Apple’s security advisories do not explicitly identify worse_query or establish a confirmed patch for the flaw.
• Binance recommends removing untrusted applications, updating devices and replacing wallet credentials if compromise is suspected.

In a November 10 security warning, the exchange identified iOS 26.7.1, 27.0.1 and 27.2 among the affected versions. It said the flaw could expose recovery phrases, private keys and login information stored locally, while stressing that the problem concerns Apple’s operating system rather than Binance alone.

A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.…

— Binance (@binance) November 10, 2026

Binance warns iOS users about worse_query vulnerability

The vulnerability involves Apple’s application sandbox, a security feature designed to prevent installed applications from accessing another app’s private files without authorization.

According to the worse_query research repository, the flaw allows an application to reach directories normally restricted to other software. The published proof of concept covers multiple iOS 26 and iOS 27 releases.

Researchers describe the issue as a sandbox escape, meaning an application could move beyond its normal file-access permissions.

The repository’s author describes worse_query as a developer proof of concept and states that it is not a jailbreak. The published material does not establish that the flaw has been used to steal cryptocurrency.

However, Binance warned that malicious applications could potentially access sensitive information if another application stores those records in files exposed through the vulnerability.

In its advisory, Binance said the risk extends “across the entire ecosystem”, including cryptocurrency wallets and other applications that retain sensitive customer data.

The exchange advised users to remove applications installed from untrusted sources, particularly manually signed or sideloaded IPA files.

It further recommended updating iOS and installed applications to their latest official versions.

Users who suspect that wallet credentials have been compromised were advised to create a new wallet on a clean device, transfer their funds and reset active login sessions.

In response to the warning, X user DUKE repeated the exchange’s advice to remove untrusted applications and replace potentially exposed wallet credentials.

Crypto wallet seed phrases could face exposure

The reported vulnerability concerns applications that store sensitive information in locations accessible through the sandbox escape.

A cryptocurrency wallet may retain encrypted key material, account information or other records on a user’s device, depending on its security design.

If an application stores recovery phrases, private keys or related credentials in readable local files, unauthorized access to those files could expose the information.

However, the existence of worse_query does not establish that every wallet stores sensitive credentials in this manner.

Wallets using encrypted storage, hardware-backed security and separate authentication controls have different exposure profiles, depending on their implementation.

The available research does not identify a confirmed compromise of MetaMask, Phantom or Trust Wallet through worse_query.

Binance’s warning follows previous incidents involving malicious iPhone applications designed to obtain cryptocurrency credentials.

As crypto.news previously reported, Binance warned users in September about FomoPeek versions 1.1 and 1.2 after researchers discovered malicious code capable of accessing information outside the application’s normal permissions.

Security firm SlowMist found that the affected software contained several exploit methods designed to gain elevated access to Apple devices.

The investigation identified risks involving locally stored recovery phrases, passwords and other account information.

Apple security updates raise questions about patch status

Apple has released several security updates covering iOS versions mentioned in Binance’s warning.

Its security release records show that iOS 27.2 became available on October 26, followed by iOS 27.2.1 on November 9.

The newer release addresses several vulnerabilities affecting user information and device security.

However, Apple’s published advisories do not explicitly identify worse_query by name, and no CVE number has been confirmed for the reported sandbox escape.

The advisories therefore do not establish whether the latest update fully addresses the specific access method described by the researcher.

In a separate September disclosure, Apple patched CVE-2026-86950, a CoreGraphics vulnerability associated with possible targeted exploitation.

That issue concerned maliciously crafted files and arbitrary code execution. No evidence establishes that it is the same vulnerability as worse_query.

An October advisory documented other file-access security fixes, including protections against unauthorized access to sensitive information.

The company’s security documentation recommends keeping devices updated, while Binance has urged customers to avoid applications from unknown publishers.

Previous iOS attacks have targeted cryptocurrency wallets

Cryptocurrency security researchers have documented separate attacks against Apple devices involving malicious applications, compromised websites and software designed to obtain wallet credentials.

On November 6, CertiK warned that an updated DarkSword exploit framework could target cryptocurrency applications on vulnerable iPhones.

The researchers identified MetaMask, Trust Wallet, Phantom, Exodus and Coinbase among applications reportedly targeted by the framework.

CertiK said some attacks could begin when a user opened a malicious website in Safari without approving a cryptocurrency transaction.

SlowMist previously warned about DarkSword activity involving compromised devices and attempts to extract locally stored private keys.

Those findings concern a separate exploit framework and do not establish that attackers have deployed worse_query against cryptocurrency users.

crypto.news contacted Binance for further comments but the exchange had not responded by press time.