Binance warns of iOS 'worse_query' flaw putting iPhone wallet keys at risk

What Binance said

Binance said the flaw affected iOS 26.7.1, 27.0.1 and 27.2 and that it wasn't specific to its own app. According to the exchange's post, worse_query lets malicious apps read local files from other apps (which puts seed phrases, private keys and login credentials at risk "across the entire ecosystem").

"This is an iOS-level issue, not unique to Binance."

Binance also listed steps for users. It urged them to delete apps installed from untrusted sources, such as sideloaded or manually signed app files, and to update iOS and all apps to the latest official versions. Anyone who suspects a breach should move funds to a new wallet created on a clean device and reset all active login sessions, the exchange said.

A sandbox escape on GitHub

iPhone apps normally run inside a sandbox that stops them from reaching other apps' private files. Worse_query is built to get around that wall.

A researcher known as forcequitOS published worse_query on GitHub as a sandbox escape for iOS 26.0 through 26.7.2 and iOS 27.2, and described it as a proof of concept for developers. According to the repository, the exploit can reach the folder where iOS apps store their data. It calls the tool the "direct successor" to an earlier exploit, bad_query.

There are no confirmed reports of crypto being stolen using the flaw.

Apple's patch doesn't name it

Apple released iOS 27.2.1 on Monday, a day after the proof of concept was published. Its security notes list fixes for nine vulnerabilities, including an App Intents authorization issue and several Bluetooth and iMessage flaws. The notes don't mention worse_query or its researcher, and Apple hasn't publicly said whether the update fixes the flaw Binance described.

23pds, chief information security officer at blockchain security firm SlowMist, urged users to update to iOS 27.2.1 and said in a tweet that the update would block the worse_query sandbox escape. That's his assessment, not Apple's.

Apple devices have been targeted by crypto-focused attacks before. Earlier this year, Google warned of iOS malware that targeted crypto apps on unpatched devices. In August, the Dutch national cyber agency said hackers were exploiting a flaw in Apple's macOS Screen Sharing feature to plant Monero miners on Macs.