Binance has published a security advisory warning iPhone and iPad users about a critical iOS vulnerability that could expose private keys, seed phrases and login credentials. The flaw resides in Apple's operating system, not in Binance's software, meaning the risk extends beyond the exchange's own customers.
What worse_query does
The vulnerability, nicknamed worse_query, affects iOS versions 26.7.1, 27.0.1 and 27.2 on both iPhones and iPads. According to Binance's advisory, it breaks down the sandbox walls that normally isolate each app, allowing a malicious app to read local files belonging to other applications.
For crypto users, this is particularly dangerous because wallet apps may store sensitive data locally. If a hostile app can access that data, it could potentially extract a seed phrase—the master recovery code that controls a wallet. Whoever holds the seed phrase effectively controls the funds.
Binance emphasized that the flaw is at the iOS level and is not specific to its apps or services. Any app storing secrets on an affected device could, in theory, be exposed.
Timeline of disclosure
Security researcher forcequitOS disclosed a proof of concept on November 8, 2026, crediting another researcher identified as 0xjohnny with the discovery. Apple responded the following day, shipping iOS 27.2.1 and iOS 26.7.3 on November 9, 2026. However, the official security notes for those updates did not explicitly confirm that worse_query had been fixed.
Binance's advisory followed on November 10. The exchange said there were no confirmed incidents of attackers using the vulnerability to compromise crypto wallets as of that date. The advisory was endorsed by Binance co-founder Yi He and by Charles Guillemet.
Binance's advice to iPhone users
Binance outlined three steps for users concerned about exposure:
- Delete untrusted apps. The attack requires a malicious app on the device, so removing anything of questionable origin reduces the risk.
- Update through official channels. Binance urged users to install updates fully and only via Apple's official process, not through third-party tools or links.
- Consider a new wallet. If users suspect their device may have been compromised, Binance suggested creating a new wallet with a freshly generated seed phrase and moving funds there. This removes the value of any stolen key.
Not the first warning this year
This is not Binance's first iOS-related alert in 2026. In September, the exchange issued an earlier advisory about a different malicious app that exploited iOS vulnerabilities.
For many crypto users, the phone has become the wallet. Exchange apps, self-custody wallets and authenticator apps often sit side by side on the same device. A flaw that lets one app peek into another turns that convenience into a concentration of risk.
What this means for crypto users and the industry
The immediate stakes fall on anyone holding self-custodied crypto on an affected iOS version. A seed phrase does not have server-side protections. If it leaks, there is no customer support line that can reverse the transfer.
Apple's silence on the fix is the key variable. Until Apple's security notes confirm worse_query is closed, users on 27.2.1 or 26.7.3 cannot be certain they are protected.
No confirmed wallet thefts have been linked to worse_query. But public proof-of-concept code tends to shorten the gap between theory and real attacks.
