Binance Alerts iPhone Users to iOS Flaw That Could Leak Crypto Wallet Keys

Binance warned iPhone users on Tuesday that a publicly known iOS vulnerability could enable malicious applications to access files stored by other apps, such as seed phrases and private keys controlling cryptocurrency wallets.

“A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem,” the exchange wrote on X. “This is an iOS-level issue, not unique to Binance.”

The exchange advised users to remove any apps installed from untrusted sources, including sideloaded or manually signed IPA files, and to update iOS and all apps to the latest official versions. If a breach is suspected, users should transfer funds to a new wallet created on a clean device and reset all active login sessions, Binance stated.

Neither Binance nor the researcher who identified the flaw has reported any thefts resulting from it.

What worse_query does

The bug functions as a sandbox escape. On iOS, each app is supposed to operate within its own container that other apps cannot read. A researcher using the handle forcequitOS released worse_query on GitHub on Nov. 8, calling it “a zero-day sandbox escape for iOS 26 and 27, again.” It follows an earlier exploit called bad_query.

The project’s README states it works on iOS 26.0 through 26.7.2 and on iOS 27.2, a broader range than the versions Binance cited. It lists accessible paths, including other apps’ data containers and shared app group folders.

The researcher describes the tool as “a proof-of-concept for developers” that “isn’t useful by itself,” and emphasizes it is not a jailbreak. To be used, a developer must build it into an app.

That has already occurred in at least one instance. A day after the release, developer Christoph Kolbicz published a file manager built on worse_query that enables users to browse and edit app data on iOS 27 without jailbreaking, which he said was tested on iOS 27.0.1.

Blockchain security firm SlowMist called worse_query a container sandbox escape rather than a jailbreak. Its chief information security officer, who posts as 23pds, wrote that the flaw will not steal assets on its own. The risk arises when a user installs and runs an untrusted IPA that then reads other apps’ containers, and only if a wallet stores mnemonic phrases, keystores or WebView caches in plain text on the device.

Apple’s iOS updates don’t mention it

Apple shipped iOS 27.2.1 and iOS 26.7.3 on Nov. 9, a day after the proof of concept went public. Their security notes list fixes for AirPlay, Bluetooth pairing, brotli and other components, but neither names worse_query or describes a sandbox escape of this kind.

That leaves it unclear whether the latest iOS builds block the technique.

The exposure depends heavily on how each wallet app stores secrets. According to SlowMist, wallets that do not write recovery phrases or keys to plain files on the device are not exposed in the same way, and hardware wallets keep private keys off the phone entirely. The attack also requires a user to install software from outside the App Store first.

The warning comes from an exchange still recovering from its own breach. Binance lost $6.34 billion in an Oct. 29 attack that began with a fake job interview. Security worries have also pushed some large holders to swap self-custodied bitcoin for IBIT shares, while hardware wallet maker Ledger said an organized crime group spent millions targeting its users.

For iPhone users holding bitcoin in a mobile wallet, Binance’s advice amounts to basic hygiene: stay on official iOS releases, skip sideloaded apps and move funds if a device may have been compromised.