Binance warned iPhone users Tuesday that a publicly released iOS flaw could allow malicious apps to read files stored by other apps, including the seed phrases and private keys that control crypto wallets.
In a post on X, the exchange said the vulnerability, known as worse_query, affects iOS 26.7.1, 27.0.1 and 27.2, putting seed phrases, private keys and login credentials at risk across the ecosystem. Binance described it as an iOS-level issue rather than one unique to its own app.
What the flaw does
The bug is a sandbox escape. On iOS, each app is supposed to operate inside its own container that other apps cannot read. A researcher posting as forcequitOS released worse_query on GitHub on Nov. 8, describing it as a zero-day sandbox escape for iOS 26 and 27 and a successor to an earlier exploit called bad_query.
The project's README states that it works on iOS 26.0 through 26.7.2 and on iOS 27.2, a wider range than the versions Binance named. It lists paths it can reach, including other apps' data containers and shared app group folders.
The researcher characterizes worse_query as a proof-of-concept for developers that is not useful by itself and stresses that it is not a jailbreak. Using it requires a developer to build it into an app.
That has already happened in at least one case. A day after the release, developer Christoph Kolbicz published a file manager built on worse_query that lets users browse and edit app data on iOS 27 without jailbreaking. He said it was tested on iOS 27.0.1.
Blockchain security firm SlowMist called worse_query a container sandbox escape rather than a jailbreak. Its chief information security officer, who posts as 23pds, wrote that the flaw will not steal assets on its own. The risk arises when a user installs and runs an untrusted IPA that then reads other apps' containers, and only if a wallet stores mnemonic phrases, keystores or WebView caches in plain text on the device.
Apple's updates do not mention it
Apple shipped iOS 27.2.1 and iOS 26.7.3 on Nov. 9, a day after the proof of concept went public. Their security notes list fixes for AirPlay, Bluetooth pairing, brotli and other components, but neither names worse_query or describes a sandbox escape of this kind.
It therefore remains unclear whether the latest iOS builds block the technique.
Exposure depends on wallet design
By SlowMist's reading, wallets that do not write recovery phrases or keys to plain files on the device are not exposed in the same way, and hardware wallets keep private keys off the phone entirely. The attack also requires a user to install software from outside the App Store first.
Binance advised users to delete any apps installed from untrusted sources, such as sideloaded or manually signed IPA files, and to update iOS and every app to the latest official versions. Anyone who suspects a breach should move funds to a new wallet created on a clean device and reset all active login sessions, the exchange said.
Neither Binance nor the researcher behind the flaw has reported any thefts tied to it.
The warning comes from an exchange still recovering from its own breach. Binance lost $6.34 billion in an Oct. 29 attack that began with a fake job interview. Security concerns have also prompted some large holders to swap self-custodied bitcoin for IBIT shares, while hardware wallet maker Ledger said an organized crime group spent millions targeting its users.
For iPhone users holding bitcoin in a mobile wallet, Binance's advice amounts to basic hygiene: stay on official iOS releases, avoid sideloaded apps and move funds if a device may have been compromised.
