Binance issued an urgent security warning on Tuesday, Nov. 10, 2026, about an iOS vulnerability known as “worse_query” that could expose cryptocurrency wallet seed phrases, private keys, and login credentials. The exchange emphasized that the flaw affects Apple’s iPhone operating system rather than Binance specifically.
Cross-App Data Exposure
According to Binance, the vulnerability affects iOS 26.7.1, 27.0.1, and 27.2, allowing malicious apps to read local files from other apps. The exchange stated that this puts seed phrases, private keys, and login credentials at risk across the entire ecosystem, and that it is an iOS-level issue, not unique to Binance.
Unlike an exchange-specific breach, worse_query concerns the isolation mechanisms designed to prevent applications from accessing one another’s private files. A successful exploit could expose locally stored cryptocurrency recovery information, potentially allowing attackers to compromise wallets if the stolen material provides sufficient access.
Binance advised users to remove applications installed from untrusted sources, including sideloaded or manually signed IPA files, and to update their devices and applications to the latest official releases. Users suspecting a compromise were also instructed to transfer their assets into newly created wallets on clean devices and terminate active login sessions.
What Is Worse_Query?
Pseudonymous security researcher forcequitOS, working with researcher 0xjohnny, published a proof-of-concept on GitHub on Nov. 8, describing worse_query as the successor to an earlier technique called bad_query. The repository identifies affected versions spanning iOS 26.0 through 26.7.2 and iOS 27.2.
Technically, the vulnerability allows an application configured with an App Group container to access directories ordinarily protected by Apple’s application sandbox. These include application data containers, internal daemon directories, Pluginkit extensions, and shared App Group storage. Certain system directories on iOS 27 are also potentially accessible.
However, the researchers emphasized that their demonstration is not a complete attack tool or a traditional jailbreak. Exploitation requires additional malicious functionality, including an application capable of collecting accessible information. For cryptocurrency holders, the distinction between accessing files and stealing funds is particularly important.
Worse_query does not automatically drain wallets, and exposure depends partly on how individual applications store and protect sensitive information. Slowmist security executive 23pds similarly cautioned that the danger materializes when malicious software encounters wallet recovery information stored in a recoverable format. As of Nov. 10, no confirmed cryptocurrency theft had been publicly attributed to worse_query.
Apple Updates and Patch Status
Apple released iOS 27.2.1, iPadOS 27.2.1, and iOS 26.7.3 on Nov. 9, shortly after the proof-of-concept became public. The security documentation identifies nine fixes addressing several components, including AirPlay, Bluetooth, Messages, App Intents, and the brotli library.
However, Apple’s published notes do not explicitly identify worse_query or confirm that the sandbox escape has been eliminated. Slowmist’s 23pds has stated that iOS 27.2.1 blocks the technique, although independent confirmation from Apple remains outstanding.
Context of Recent Threats
The advisory follows an Oct. 24 warning from Slowmist concerning Darksword, a separate iOS exploit framework targeting cryptocurrency users. Unlike worse_query, Darksword can exploit malicious webpages without requiring victims to install applications. Researchers identified more than 1,500 associated phishing sites impersonating exchanges, wallets, and other online services.
The warning also arrives less than two weeks after Binance’s Oct. 29 security breach, which involved approximately $6.3 billion in stolen cryptocurrency. That incident concerned compromised internal infrastructure rather than the iOS vulnerability or private key leaks. The two events have not been linked.
For cryptocurrency holders, the latest discovery illustrates how operating-system weaknesses can threaten assets even when blockchain networks themselves remain uncompromised. The immediate concern is not a demonstrated wave of theft, but the possibility that sensitive wallet credentials could become accessible through software users mistakenly trust.
