Binance has warned iPhone users about a security vulnerability in iOS that could expose cryptocurrency wallet seed phrases and private keys. The flaw, known as worse_query, allows malicious apps to bypass Apple's sandbox protections and read files stored by other applications.
Security researchers identified the vulnerability as affecting iOS versions 26.7.1, 27.0.1, and 27.2. According to the researchers, the bug remains unpatched in iOS 27.2.1 and has not been fixed in the iOS 27.3 beta.
How the Vulnerability Works
The iPhone's sandbox is a core security feature designed to keep each app isolated so that one application cannot access another app's files. The worse_query flaw circumvents this protection, enabling unauthorized file access across the iOS ecosystem.
Researchers published a proof of concept demonstrating how the vulnerability could be exploited. Developers have already built working applications using the flaw, including a file manager capable of accessing, modifying, and deleting data from other apps. These applications function without requiring a jailbreak.
Binance's Recommended Actions
Binance advised iPhone users to take immediate protective steps:
- Delete any apps installed from untrusted sources, including sideloaded apps and manually signed IPA files
- Update iOS and all applications to the latest official versions
- Move cryptocurrency funds to a new wallet created on a clean device
- Reset all active login sessions to prevent unauthorized account access
Current Status
No attacks or cryptocurrency thefts linked to the worse_query vulnerability have been reported. Apple's security update for iOS 27.2.1 did not include a fix for this issue.
