Binance Warns iPhone Users of iOS Security Flaw That Could Expose Crypto Wallet Keys

Binance has warned iPhone users about a newly disclosed iOS vulnerability that could allow malicious apps to access files belonging to other applications, potentially exposing cryptocurrency wallet recovery phrases, private keys and login credentials.

The vulnerability, known as worse_query, affects several iOS versions, including iOS 26.7.1, iOS 27.0.1 and iOS 27.2, according to Binance. The cryptocurrency exchange warned that the issue involves Apple's operating system rather than a security weakness exclusive to its own applications.

In a security warning published on November 10, Binance explained that malicious applications could potentially bypass normal iOS file restrictions and access sensitive information stored by other apps.

The exchange urged users to remove applications installed from untrusted sources, including sideloaded apps and manually signed IPA files. It also recommended installing the latest official iOS and application updates.

What Is the worse_query iOS Vulnerability?

The worse_query vulnerability involves Apple's app sandboxing system, a security mechanism designed to keep applications isolated from one another.

Under normal circumstances, an iPhone application cannot freely access files or private information stored by another application. This separation helps protect sensitive data, including cryptocurrency wallet credentials and personal information.

However, the worse_query exploit reportedly allows malicious applications to bypass certain sandbox restrictions and access files stored in other apps' directories.

A security researcher operating under the name forcequitOS published the proof-of-concept exploit on GitHub on November 8. The researcher described it as a sandbox escape affecting multiple iOS 26 and iOS 27 releases.

The published project is intended as a proof of concept for developers and is not a jailbreak. However, its potential use inside a malicious application has raised concerns among cryptocurrency security researchers.

If an affected iPhone runs an application containing the exploit, attackers could potentially access sensitive information stored by other applications.

Could the iPhone Security Flaw Expose Cryptocurrency Wallets?

The biggest concern surrounding worse_query is the possibility of exposing cryptocurrency wallet recovery phrases and private keys.

A recovery phrase, also known as a seed phrase, allows users to restore access to their cryptocurrency wallets. Anyone who obtains this information could potentially gain control of the associated digital assets.

Private keys serve a similar purpose by allowing users to authorize cryptocurrency transactions. If malicious software gains access to these credentials, users could face serious financial losses.

However, the vulnerability does not automatically expose every cryptocurrency wallet installed on an iPhone.

The actual risk depends on how individual applications store sensitive information. Wallets that keep recovery phrases or private keys in accessible, unencrypted files could face greater exposure than applications using stronger storage protections.

Binance also clarified that it had not identified any confirmed cases of attackers using worse_query to access cryptocurrency wallets or steal funds.

Blockchain security firm SlowMist similarly explained that the exploit does not independently steal cryptocurrency. An attacker would first need to get malicious software installed and running on the affected device.

Has Apple Fixed the worse_query Vulnerability?

Apple released iOS 27.2.1 and iOS 26.7.3 on November 9, shortly after the vulnerability became publicly known.

However, Apple's published security notes do not explicitly identify worse_query or confirm that these updates address the specific sandbox escape.

Security researchers have offered some reassurance about the newer releases. SlowMist's chief information security officer, known as 23pds, indicated that updating to iOS 27.2.1 could block the exploit.

Nevertheless, Apple has not publicly confirmed a specific fix for worse_query, and users should not assume that installing an update guarantees protection against this particular issue.

Binance advised iPhone owners to install the latest official software updates and monitor Apple's security announcements for further information.

How iPhone Users Can Protect Their Crypto Wallets

Binance has recommended several precautionary measures for users concerned about the vulnerability.

Here are the most important steps:

• Remove untrusted applications: Delete suspicious apps, particularly those installed through sideloading or manually signed IPA files.
• Update iOS: Install the latest officially available iOS version through Apple's software update settings.
• Update applications: Make sure cryptocurrency wallets and other installed apps are running their latest official versions.
• Use a trusted device: Avoid accessing cryptocurrency accounts from an iPhone that may have been compromised.
• Create a new wallet if necessary: If sensitive wallet information may have been exposed, generate a replacement wallet on a clean device and transfer your assets.
• Reset active sessions: Change potentially exposed login credentials and sign out of active sessions.

Users should also avoid sharing recovery phrases, private keys or verification codes with anyone claiming to offer technical support.

What iPhone Owners Should Know About the Binance Warning

The worse_query vulnerability highlights the importance of application security on smartphones, particularly for people who store cryptocurrency and other valuable digital information on their devices.

Although there are currently no confirmed reports of cryptocurrency theft linked to this exploit, its ability to bypass normal application isolation makes it a security concern worth taking seriously.

For now, iPhone users should avoid installing applications from unknown sources, keep their devices updated and review the security practices of their cryptocurrency wallets.

Until Apple provides clearer confirmation about the vulnerability and its mitigation, taking these precautions is the safest approach.