Binance warned on X about a security flaw in iPhones called “worse_query.” The flaw lets malicious apps read files from other apps, which puts crypto seed phrases, private keys, and login details at serious risk. A seed phrase is the list of words that restores a crypto wallet, so anyone who gets hold of it can take the coins.
Binance and KuCoin Flag iOS 26.7.1, 27.0.1 and 27.2
Binance identified the affected versions as iOS 26.7.1, 27.0.1 and 27.2. It called the flaw “an iOS-level issue, not unique to Binance,” meaning the problem lies in the iPhone’s software rather than in the Binance app. KuCoin issued a similar advisory, warning that users’ wallet recovery details might be exposed. An iPhone’s version appears under Settings, then General, then About.
As of November 10, Apple (NASDAQ: AAPL | AAPL Price Prediction) had not released any statement or patch for the worse_query flaw. The company typically holds back comments on security issues until a fix is generally available.
An Offline Seed Phrase Stays Safe Before Apple Releases a Fix
Until Apple releases a fix, Binance advises users to uninstall apps from untrusted sources, because the flaw needs a malicious app on the phone to work. However, phones are only one weak point, as Revolut showed when it handed over customer records in response to a fake government request.
The safest place for a seed phrase is offline. Notes, photos, and screenshots on a phone are files that harmful apps can read, while a seed phrase written on paper or engraved in metal stays out of reach.
A hardware wallet also keeps private keys off the phone, but it’s safest to buy one directly from the manufacturer, since hackers once sold tampered wallets through a reseller. The Coldcard hack showed that even hardware wallets carry risk. Once Apple releases a patch, an iPhone update could close this security gap.
Which iOS Versions Are at Risk From the iPhone Flaw?
Binance and KuCoin have flagged iOS 26.7.1, 27.0.1, and 27.2 as the versions at risk. Since Apple has not confirmed a fix yet, Binance advises steering clear of untrusted apps, and any seed phrase stored in notes, photos, or screenshots on those versions could be exposed.
An offline seed phrase stays safe on every iOS version, whether or not a patch arrives. That backup also gives family members a way to reach the coins later, as a guide to what happens to your crypto when you die explains.
Contact [email protected] for any questions or corrections.
Sam Daodu is a crypto analyst and the editor of 24/7 Wall St.'s Crypto Desk, where he covers Bitcoin, XRP, Ethereum, Solana and the altcoins investors search for most. His work focuses on price levels, spot ETF flows, on-chain data and the regulatory decisions that move crypto markets, written so a first-time buyer and a seasoned trader can both use it.
Sam has written about crypto professionally since 2019 and has published more than 2,000 articles. Before joining 24/7 Wall St., he wrote for crypto media outlets and Web3 companies and ghostwrote for crypto founders and token launches. His analysis is syndicated on Yahoo Finance, MSN and AOL and has been cited by other crypto news sites. He also founded MacLabs Marketing, a content and personal branding agency for crypto founders and executives.
When he isn't reading charts, Sam is usually at the gym or watching One Piece, a series he maintains has better tokenomics than most altcoins.
