Binance warns iPhone users of iOS flaw that may expose wallet keys

What happened

Binance issued a security warning on Tuesday, Nov. 10, telling iPhone users that an iOS vulnerability could expose cryptocurrency wallet recovery phrases and private keys when a malicious app runs on an affected device. Crypto.news reported that the issue is known as worse_query and involves access to files that normally belong to other applications. Cointelegraph also covered the warning.

The exchange listed iOS 26.7.1, 27.0.1 and 27.2 among the affected versions. According to the reports, the flaw could allow malicious software to read local files from other apps, putting seed phrases, private keys and login credentials at risk. Binance described the problem as an iOS-level issue rather than one limited to its own app, saying the risk spans the wider ecosystem.

Research cited by Crypto.news describes worse_query as a sandbox escape, meaning an app could move beyond its normal file-access limits. A published proof of concept covers multiple iOS 26 and iOS 27 releases. The repository's author calls it a developer proof of concept and says it is not a jailbreak. Binance advised users to delete apps installed from untrusted sources, especially manually signed or sideloaded IPA files, and to update iOS and all apps to official versions. If a breach is suspected, the exchange recommended creating a new wallet on a clean device, transferring funds and resetting active login sessions.

Why it matters

Wallet recovery phrases and private keys are the credentials that control crypto funds, so any path that lets one app read another app's local files is significant for wallet users. The risk depends on how a wallet stores sensitive material. A wallet that keeps recovery phrases or keys in readable local files could be exposed through the flaw, while wallets using encrypted storage, hardware-backed security and separate authentication have different exposure profiles.

The available research does not establish that worse_query has been used to steal cryptocurrency, and it does not identify a confirmed compromise of MetaMask, Phantom or Trust Wallet through this flaw. Binance's warning nonetheless matters because the underlying issue is in Apple's operating system and could affect wallets and other apps that retain sensitive customer data, not just Binance's own software.

What the data shows

Binance's warning names iOS 26.7.1, 27.0.1 and 27.2. Apple's release records show iOS 27.2 became available on Oct. 26, followed by iOS 27.2.1 on Nov. 9. Cointelegraph reported that Apple also released iOS 26.7.3 on Monday. The proof of concept for worse_query covers multiple iOS 26 and iOS 27 releases, according to Crypto.news.

Background

The warning follows earlier incidents involving malicious iPhone apps designed to obtain crypto credentials. In September, Binance warned users about FomoPeek versions 1.1 and 1.2 after researchers found malicious code capable of reaching information outside the app's normal permissions. Security firm SlowMist found that the software contained exploit methods intended to gain elevated access to Apple devices, with risks involving locally stored recovery phrases, passwords and account information.

Separately, on Nov. 6, CertiK warned that an updated DarkSword exploit framework could target cryptocurrency applications on vulnerable iPhones. The researchers named MetaMask, Trust Wallet, Phantom, Exodus and Coinbase among apps reportedly targeted. CertiK said some attacks could begin when a user opened a malicious website in Safari without approving a crypto transaction. SlowMist had previously warned about DarkSword activity involving compromised devices and attempts to extract locally stored private keys. Those findings concern a different exploit framework and do not show that attackers have deployed worse_query against crypto users.

What is still unclear

It remains unclear whether Apple's newest updates fix the flaw. Apple's security advisories do not explicitly identify worse_query or establish a confirmed patch, according to Crypto.news. There is also no public evidence in the reports that the vulnerability has been exploited to steal crypto. Crypto.news said it contacted Binance for further comment, but the exchange had not responded by press time.

What to watch

The next signals to watch are whether Apple confirms a fix or names the issue in a security advisory, and whether security researchers report exploitation in the wild. Binance's warning may also prompt other wallet providers to review how they store recovery phrases and private keys on iPhones.

Questions readers ask