Binance has warned iPhone users that a flaw in Apple's iOS could let malicious apps read files belonging to other apps — including the seed phrases and private keys that control crypto wallets. The exchange issued the warning on Tuesday, saying the problem sits at the operating-system level and is not specific to Binance or any single wallet.
The flaw, dubbed "worse_query" by the security researcher who disclosed it, is described as a sandbox escape. On iOS, each app is supposed to live in its own sealed container that other apps cannot read. The researcher, who posts as forcequitOS, published a public proof of concept on GitHub on November 8, calling it "a zero-day sandbox escape for iOS 26 and 27, again."
Binance named iOS 26.7.1, 27.0.1 and 27.2 as affected versions, warning that seed phrases, private keys and login credentials stored locally could be exposed. "This is an iOS-level issue, not unique to Binance," the exchange wrote in its post on X.
What the flaw can — and cannot — do
The researcher's documentation says the technique works across a wider range of versions than Binance named: iOS 26.0 through 26.7.2, alongside iOS 27.2. Blockchain security firm SlowMist described it as a container sandbox escape rather than a jailbreak, and noted that it requires the malicious app to have an App Group container. It does not require a jailbreak, and a developer has already built a file-browser tool that reimplements the technique without a kernel exploit.
Importantly, the flaw does not automatically drain wallets. Access to an app's files does not necessarily reveal usable private keys, and the documentation does not establish that worse_query can decrypt every wallet or bypass all credential protections. SlowMist's security chief separately warned that untrusted IPA packages — apps installed from outside the App Store — could use the access to expose wallet recovery phrases, keystores or browser cache data stored without encryption.
Neither Binance nor the researcher has reported any thefts tied to the flaw. A Binance spokesperson told crypto.news that the warning was based on published technical evidence, but that the exchange had "not identified any confirmed cases in which attackers used worse_query to access cryptocurrency wallets or steal funds."
Patch status remains unclear
Apple shipped iOS 27.2.1 and iOS 26.7.3 on November 9, a day after the proof of concept went public. But the security notes for those updates list fixes for AirPlay, Bluetooth pairing and other components, and neither names worse_query or describes a sandbox escape of this kind. Binance said it does not currently have verified information confirming a security patch or a CVE number for the flaw, and Apple has not publicly confirmed a vulnerability under the name "worse_query."
The warning was also shared by Binance co-founder Yi He and by Charles Guillemet, chief technology officer at hardware wallet maker Ledger, who highlighted the risks for users who keep sensitive wallet information on mobile devices.
What iPhone users should do
Binance advised users to delete any apps installed from untrusted sources, such as sideloaded or manually signed IPA files, and to update iOS and every app to the latest official versions. The exchange also recommended replacing wallet credentials if a compromise is suspected.
Security researchers say the simplest protection is also the most effective: only install apps from the App Store, keep iOS updated, and avoid storing seed phrases in plain text on a phone. For larger holdings, moving funds to a hardware wallet removes the keys from the phone entirely — and out of reach of any app that slips past the sandbox.
