Binance warns iPhone users of iOS “worse_query” bug that could expose wallet keys Binance has issued an alert to iPhone users about a newly disclosed iOS vulnerability, dubbed “worse_query,” that could allow malicious apps to read files belonging to other apps — potentially exposing locally stored wallet recovery phrases, private keys and login data. The exchange emphasized this is an operating-system level issue affecting the broader Apple ecosystem, not a flaw unique to Binance. What the bug does - worse_query is described as a sandbox escape: it undermines Apple’s application sandbox, the mechanism that normally prevents apps from accessing one another’s private files. - A published proof-of-concept shows an app reaching directories that should be off-limits. The POC covers multiple releases of iOS 26 and iOS 27. - The POC’s author frames worse_query as a developer proof-of-concept and not a jailbreak. There is currently no public evidence that the vulnerability has been used in real-world thefts of cryptocurrency. Affected iOS versions Binance named iOS 26.7.1, 27.0.1 and 27.2 among the versions impacted. Why crypto wallets could be at risk - The vulnerability could expose any sensitive data stored in readable local files: seed phrases, private keys, encrypted key material, account info and login credentials — depending on how an individual wallet stores them. - Wallets that use encrypted storage, hardware-backed key stores, or separate authentication layers present a lower exposure, while apps that keep plaintext or easily readable credentials on-device are more vulnerable. - Binance, and current research, do not report confirmed compromises of major wallets such as MetaMask, Phantom or Trust Wallet via worse_query. Binance’s guidance to users Binance urged users to: - Remove apps from untrusted sources, especially manually signed or sideloaded IPA files. - Update iOS and all installed apps to the latest official versions. - If you suspect your wallet credentials have been exposed: create a new wallet on a clean device, transfer funds, and reset active login sessions. Wider context and related threats - This advisory follows several recent incidents where malicious iPhone apps aimed to extract wallet credentials. In September researchers flagged malicious FomoPeek builds that contained code to access data outside normal app permissions. - Security firms have also highlighted the DarkSword exploit framework as a current threat to iPhone crypto apps. On November 6 CertiK reported DarkSword activity targeting apps including MetaMask, Trust Wallet, Phantom, Exodus and Coinbase, sometimes triggered by visiting malicious websites in Safari. - SlowMist has linked DarkSword activity to attempts at extracting locally stored private keys. These findings are about separate exploit frameworks and do not prove worse_query has been weaponized. Apple’s updates and uncertainty - Apple has released security updates covering the iOS versions Binance named: iOS 27.2 (released Oct. 26) and iOS 27.2.1 (released Nov. 9). Those updates address multiple vulnerabilities affecting user information and device security. - However, Apple’s advisories do not explicitly name worse_query, and no CVE has been publicly assigned to the reported sandbox escape — so it’s unclear whether the specific POC access method is fully addressed by the latest patches. - A previously patched issue (CVE-2026-86950 in CoreGraphics) was fixed in September but is not confirmed to be related to worse_query. Bottom line The risk from worse_query centers on whether individual apps store sensitive credentials in files that could be read by another app. Users should update iOS and apps, remove untrusted/sideloaded apps, and follow Binance’s remediation steps if they suspect compromise. While there is no confirmed exploit campaign tied to worse_query yet, the disclosure adds to a steady stream of iOS-targeting threats that demand vigilance from crypto holders. Binance had not responded to requests for further comment at the time of publication. Read more AI-generated news on: https://app.chaingpt.org/news