Update (November 10, 2026): This article has been updated to include comments from a Binance spokesperson.
Binance has warned iPhone users about an iOS vulnerability known as “worse_query” that could allow malicious applications to access files belonging to other apps, potentially exposing cryptocurrency wallet credentials.
Summary
- Binance warns that worse_query could allow malicious applications to access files belonging to other iOS apps.
- The exchange identified iOS 26.7.1, 27.0.1 and 27.2 among versions affected by the vulnerability.
- Cryptocurrency recovery phrases and private keys could face exposure if applications store them in accessible files.
- Apples security advisories do not explicitly identify worse_query or establish a confirmed patch for the flaw.
- Binance recommends removing untrusted applications, updating devices and replacing wallet credentials if compromise is suspected.
In a November 10 security warning, the exchange identified iOS 26.7.1, 27.0.1 and 27.2 among the affected versions. It said the flaw could expose recovery phrases, private keys and login credentials stored locally, while stressing that the problem concerns Apples operating system rather than Binance alone.
A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.…
— Binance (@binance) November 10, 2026
Speaking to crypto.news, a Binance spokesperson confirmed that the warning was based on published technical evidence. However, the exchange said it had not identified any confirmed incidents involving cryptocurrency theft through the vulnerability.
Binance confirms iOS vulnerability could expose crypto wallet files
The vulnerability involves Apple‘s application sandbox, a security feature designed to prevent installed applications from accessing another app’s private files without authorization.
According to the worse_query research repository, the flaw allows an application to reach directories normally restricted to other software. The published proof of concept covers multiple iOS 26 and iOS 27 releases.
Researchers describe the issue as a sandbox escape, meaning an application could move beyond its normal file-access permissions.
The repositorys author describes worse_query as a developer proof of concept and states that it is not a jailbreak.
Explaining the potential exposure, the Binance spokesperson said malicious applications installed and running on affected devices could read local files belonging to other applications.
“Seed phrases, private keys and login credentials could be exposed if stored in those files in plaintext or otherwise recoverable form,” the spokesperson said.
The exchange added that the actual exposure depends on each applications storage methods and encryption protections.
Asked whether attackers had already exploited the vulnerability to compromise cryptocurrency wallets, the spokesperson said, “At present, we have not identified any confirmed cases in which attackers used worse_query to access cryptocurrency wallets or steal funds.”
Binance explains risks to its iOS app and other crypto wallets
The reported vulnerability concerns sensitive information stored in files that malicious applications could access through the sandbox escape.
A cryptocurrency wallet may retain encrypted key material, account information or other records on a users device, depending on its security design.
However, the existence of worse_query does not establish that every wallet stores recovery phrases or private keys in a form that attackers could recover.
When asked whether its own application was affected, Binance confirmed that the underlying file-access risk could extend to its iOS app and other applications running on vulnerable devices.
“This is an iOS-level vulnerability in the isolation between applications, not an issue specific to Binance or a particular wallet provider,” the spokesperson said.
The exchange explained that individual applications have different storage, encryption and access controls, which determine whether sensitive information could be exposed.
Binances warning follows previous incidents involving malicious iPhone applications designed to obtain cryptocurrency credentials.
As previously reported, Binance warned users in September about FomoPeek versions 1.1 and 1.2 after researchers discovered malicious code capable of accessing information outside an applications normal permissions.
Security firm SlowMist found that the affected software contained several exploit methods designed to gain elevated access to Apple devices.
Apple patch and CVE status remain unconfirmed
Questions remain over whether Apple has released a security update specifically addressing worse_query.
The Apple security release records list updates for affected iOS versions, but the available advisory information does not establish a confirmed fix for this particular vulnerability.
Asked whether Apple had been notified, the Binance spokesperson said the researchers public statements indicated that the issue had been reported to the company.
“We do not currently have verified information confirming a security patch or a CVE number for this specific vulnerability,” the spokesperson said.
The exchange advised users to follow Apples official security announcements and install the latest available operating system updates.
Separately, cryptocurrency security researchers have documented other threats involving Apple devices and digital asset wallets.
On November 6, CertiK warned that an updated DarkSword exploit framework could target cryptocurrency applications on vulnerable iPhones.
The researchers identified MetaMask, Trust Wallet, Phantom, Exodus and Coinbase among applications reportedly targeted by that framework.
Those findings concern a separate security threat and do not establish that worse_query has been exploited against the named wallets.
Binance advises users to replace potentially exposed wallet credentials
Binance has recommended removing applications installed from untrusted sources, particularly unknown sideloaded or manually signed IPA packages.
The spokesperson said users should obtain iOS updates and application updates through official channels while avoiding software from unknown publishers.
For cryptocurrency holders who suspect that sensitive wallet information has been exposed, Binance recommended creating and backing up a new wallet on a trusted device.
Users should then transfer their assets to the replacement wallet and stop using the old addresses.
Where login credentials may have been compromised, the exchange recommended changing passwords and resetting active sessions from a trusted device.
Binance further advised users to report suspicious activity through its official support channels, retaining relevant installation records, wallet addresses and transaction hashes.
The spokesperson warned users never to share seed phrases, private keys or verification codes when seeking assistance.
Read more:
Public companies have sold $8.08 billion in Bitcoin in 2026: Lookonchain