Key Takeaways:
- Binance issued an urgent alert, warning that an iOS security flaw called worse_query lets malicious apps read private files from other apps on an iPhone.
- The bug affects iOS versions 26.0 through 27.2 and can expose crypto seed phrases, private keys, and login sessions.
- Users who only download apps from the App Store remain safe, though experts urge everyone to update to iOS 27.2.1 or 26.7.3 immediately.
User Score
9
Crypto exchange Binance issued a security alert, warning iPhone users about an iOS flaw called worse_query that could allow malicious apps to steal crypto wallet seed phrases, private keys, and login details.
A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.
Immediate Action Required:
– Delete any apps installed from untrusted sources (such as sideloaded or manually signed IPAs).
– Update iOS and all apps to the latest official versions.
– If you suspect a breach, transfer funds to a new wallet created on a clean device and reset all active login sessions.Never install unauthorized packages, and keep your software up to date.
— Binance (@binance) November 10, 2026
A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.
Immediate Action Required:
– Delete any apps installed from untrusted sources (such as sideloaded or manually signed IPAs).
– Update iOS and all apps to the latest official versions.
– If you suspect a breach, transfer funds to a new wallet created on a clean device and reset all active login sessions.
Never install unauthorized packages, and keep your software up to date.
— Binance (@binance) November 10, 2026
Table of Contents
How the worse_query Flaw Works and What Versions Are Hit
Escaping the iPhone App Sandbox
Apple locks every iPhone app inside its private sandbox so one app can’t peek at files stored by another app. worse_query is a sandbox escape flaw, not an iPhone jailbreak that can break down that wall.
Binance has just issued a warning about an iOS vulnerability called worse_query
Read Next: Binance CFO Kaiser Ng Steps Down After Five Years, Days After $6.3 Billion Hack
The proof of concept code was published on GitHub by security researcher Taj C ( which is known as forcequitOS) in collaboration with 0xjohnny, serving as a direct follow up to an earlier bug called bad_query.
Binance’s alert flagged iOS versions 26.7.1, 27.0.1, and 27.2, the researcher’s GitHub page notes that the flaw can affect a huge range of systems, including iOS 26.0, 26.7.2 and iOS 27.2.
Why Sideloaded Apps Carry the Highest Risk
By exploiting the bug, an app with App Group permissions can read local files inside /var/mobile/Containers/Data/Application/*, with shared app folders, plugins, and system containers on iOS 27. If a wallet app stores seed phrases, keystores, or web cache data in plain, unencrypted text, a malicious app on the same phone could read and steal them.
The flaw is that they can’t steal funds by themselves. A user has to install and open a malicious app, an unofficial .ipa file sideloaded from outside Apple’s App Store. Because of this, users who download apps from the App Store are safe, and as of November 10, there have been no confirmed reports of hackers using worse_query to drain crypto wallets.
Apple’s Latest Updates and How Users Should Protect Their Funds
One day before Binance’s warning, Apple released iOS 27.2.1 and iOS 26.7.3. Apple’s security notes listed nine bug fixes through AirPlay, Bluetooth, iMessage, and App Intents, including a patch stopping apps from accessing data through App Intents, without naming worse_query.
Even without any confirmation from Apple, security experts, including SlowMist CISO 23pds, believe the iOS updates block the attack technique and advise all crypto holders to update their phones immediately.
To stay safe across all apps, the exchange and security researchers recommend taking three steps. First, delete any sideloaded apps or signed .ipa packages from untrusted sources. Second, update iOS and all installed crypto apps to the latest versions. Third, anyone who installed unofficial apps on a phone holding crypto should move their funds to a new wallet and reset all active login sessions.
Read Next: U.S. Secret Service and FBI Investigate Historic $6.4 Billion Binance Hack Tied to North Korea
Leith Willie
Leith Willie is a Crypto and Technology News Writer at Techiexpert, with over 4 years of experience covering cryptocurrency, blockchain, digital assets, and financial technology developments. Her reporting focuses on the events shaping the crypto industry, including regulation, institutional adoption, exchange developments, blockchain networks, cybersecurity, tokenization, and digital-asset infrastructure. Leith specializes in interpreting complex industry and regulatory developments and explaining what they mean for cryptocurrency users, businesses, investors, and the wider blockchain ecosystem.
