Binance Issues Urgent Warning on iOS Vulnerability

Cryptocurrency exchange Binance has warned Apple iPhone users about a security flaw known as "worse_query" in specific iOS releases. The issue, identified on November 10, 2026, allows malicious applications to read local files belonging to other apps. This bypasses the standard iOS application sandbox, which normally isolates software to prevent unauthorized access to private data.

The affected versions include iOS 26.7.1, 27.0.1 and 27.2. Binance stated that the flaw could expose seed phrases, private keys and login credentials stored on the device. It emphasized that this is an iOS-level problem affecting the entire ecosystem, not limited to any single platform or wallet.

The exchange advised users to delete any apps installed from untrusted sources, such as sideloaded or manually signed files. It also recommended updating iOS and all installed applications to the latest official versions.

Those who suspect a breach should create new wallets on clean devices, transfer funds there and reset all active login sessions, according to Binance.

How the Vulnerability Works

The "worse_query" exploit represents a sandbox escape on iOS, a security feature designed to keep apps separated from one another. A researcher who goes by forcequitOS published the details on GitHub as a proof of concept for developers, describing it as a direct successor to an earlier issue called bad_query.

The flaw impacts iOS versions from 26.0 through 26.7.2 and 27.2. It targets directories normally restricted to other applications, including those where data might be stored. No confirmed cases of cryptocurrency theft using this method have been reported, and the researcher noted it is not a jailbreak.

Apps that store sensitive information in accessible local files face the highest risk. This includes recovery phrases and private keys if held in plain view rather than in encrypted or hardware-protected storage.

Apple's Latest Updates and Patch Status

Apple released iOS 27.2.1 on November 9, 2026, along with iOS 26.7.3. The company's security notes address nine vulnerabilities, including issues with App Intents and Bluetooth features. However, they do not mention "worse_query" by name or provide a CVE identifier for the sandbox escape.

Apple has not publicly confirmed whether the update resolves the flaw. Security expert 23pds, chief information security officer at blockchain security firm SlowMist, stated that the release would block the worse_query sandbox escape. Binance users are still urged to apply the latest official iOS version to mitigate the risk.

Broader Context of iPhone Security Risks for Crypto Users

Binance's warning follows recent incidents involving malicious applications targeting crypto wallets on iOS devices. In September, the exchange alerted users to FomoPeek versions 1.1 and 1.2, which researchers linked to exploits that could gain elevated access and expose recovery phrases, private keys and account information.

Security firm CertiK reported on November 6 about an updated DarkSword exploit framework that targets cryptocurrency applications on unpatched iPhones. The kit can potentially activate through opening a malicious site in Safari, with no transaction signature required in some cases. It has been linked to wallets such as MetaMask, Phantom, Trust Wallet and others.

These cases underscore the need for caution when installing third-party software on iPhones, especially apps that manage digital assets.

User Recommendations and Preventive Measures

Binance's guidance focuses on maintaining device security through regular updates and avoiding untrusted installations. Users should also monitor for any signs of compromise, such as unusual app behavior or unexpected data access.

The exchange highlighted that the risk extends beyond its own services to any application storing sensitive local data, including passwords and personal files. Creating a new wallet on a verified device and transferring assets remains the primary step for suspected issues.