Binance has issued an urgent security advisory to iPhone users after researchers uncovered an iOS vulnerability that could expose sensitive cryptocurrency wallet information. The flaw, known as "worse_query," may enable malicious applications to access private files belonging to other apps.

In a November 10 advisory, the exchange identified iOS versions 26.7.1, 27.0.1, and 27.2 as potentially affected, cautioning that attackers could reach private keys, wallet recovery phrases, and login credentials stored on vulnerable devices.

How the Flaw Works

The worse_query vulnerability targets Apple's application sandbox — a core layer of the company's mobile security architecture that normally prevents apps from accessing each other's private information. Researchers demonstrated that the flaw could bypass certain file-access restrictions and expose directories belonging to other applications.

The weakness does not automatically compromise every cryptocurrency wallet, however. Actual risk depends on how individual applications store and protect sensitive information. Wallets that keep recovery phrases or private keys in accessible local files could face greater exposure, while applications using stronger encryption and hardware-backed security may carry additional protections against unauthorized access.

The published research describes worse_query as a proof-of-concept exploit. No confirmed cryptocurrency theft has been directly linked to the vulnerability.

Binance's Recommendations

Binance advised iPhone owners to immediately review installed applications and remove software obtained from untrusted sources, with the warning specifically highlighting sideloaded applications and manually signed IPA files. Such software is installed outside Apple's App Store and therefore does not pass through the store's standard review process.

The exchange also recommended updating iOS and installed applications to their latest official versions. Apple's published security advisories, however, have not explicitly confirmed whether recent updates fully address worse_query; until such a confirmation appears, those published advisories remain the primary reference for tracking Apple's patch status.

Users who suspect their wallet credentials have been exposed should create a new wallet on a trusted device, transfer their cryptocurrency holdings, and reset potentially compromised login sessions.

Broader Mobile Security Concerns

The advisory underscores wider security challenges surrounding mobile cryptocurrency storage. Unlike traditional banking accounts, self-custody wallets rely on private keys that directly control access to digital assets. Anyone who obtains a wallet's recovery phrase may gain control of its funds without requiring the owner's authorization, and because blockchain transactions cannot typically be reversed by a central intermediary, stolen self-custody funds are generally difficult to recover — making the protection of these credentials essential for cryptocurrency investors.

Binance's latest warning follows earlier alerts involving malicious iPhone applications designed to steal sensitive financial information. Although researchers have not confirmed active exploitation of worse_query against crypto wallets, the discovery reinforces the importance of maintaining strong device security.