Binance has warned iPhone users about a vulnerability in Apple's iOS that it says could allow malicious apps to read files stored by other apps, putting crypto wallet seed phrases, private keys and login credentials at risk.

The flaw, dubbed "worse_query," affects iOS 26.7.1, 27.0.1 and 27.2, the exchange said in a post on X on Tuesday. Binance stressed that the weakness spans the entire Apple ecosystem rather than being limited to any single app or platform, and is not unique to the exchange itself.

A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.…

— Binance (@binance) November 10, 2026 (via X)

What Binance Advised

The exchange urged users to delete any apps installed from untrusted sources, such as sideloaded or manually signed app files, and to update iOS and all installed apps to the latest official versions. Anyone who suspects a breach should move their funds to a new wallet created on a clean device and reset all active login sessions, Binance said. The focus on a fresh wallet reflects the nature of seed phrases: they are the master credentials from which self-custody wallets derive their private keys, and unlike passwords they cannot be changed.

How the Flaw Works

iPhone apps normally run inside a sandbox, a security boundary designed to stop them from accessing other apps' private files. A researcher who goes by forcequitOS published worse_query on GitHub as a sandbox escape for iOS 26.0 through 26.7.2 and iOS 27.2, describing it as a proof of concept for developers that "isn't useful by itself."

Among the locations the exploit can reach, according to the repository, is the folder where iOS apps store their data. That storage layer is also where self-custody wallet apps keep seed phrases and key material, which is why sandbox escapes draw close attention from crypto security firms. The repository calls worse_query the "direct successor" to an earlier exploit, bad_query.

There have been no confirmed reports of cryptocurrency being stolen by exploiting the flaw to date.

Apple's Update

Apple released iOS 27.2.1 on Monday, one day after the proof of concept was published. Its security notes list fixes for nine vulnerabilities, including an authorization issue in App Intents through which "an app may be able to access sensitive user data," as well as several Bluetooth and iMessage flaws.

However, the notes do not mention worse_query or its researcher, and Apple has not publicly confirmed whether the update addresses the flaw Binance described. At least one security expert believes it does. 23pds, chief information security officer at blockchain security firm SlowMist, urged users to update to iOS 27.2.1, saying in a post on X that the update would block the worse_query sandbox escape, along with other threats. Because Apple's notes are its only public record of a release's fixes, third-party assessments such as SlowMist's stand as the most specific public guidance on the flaw so far.

Not the First Time

It is not the first time attackers have targeted Apple devices. Earlier this year, Google warned of iOS malware that targeted crypto apps on unpatched devices, while in August, the Dutch national cyber agency said hackers were exploiting a flaw in Apple's macOS Screen Sharing feature to plant Monero miners on Macs. For iPhone-holding crypto users, the episodes underline that an operating system's defenses are the first line of protection for keys stored on a device.