Binance has warned iPhone users about an iOS vulnerability known as “worse_query” that could allow malicious applications to read local files belonging to other apps. The exchange said the issue may expose sensitive information stored by cryptocurrency wallets, including seed phrases, private keys and login credentials.

The vulnerability affects iOS versions 26.7.1, 27.0.1 and 27.2, according to Binance. It is an issue at the Apple operating-system level rather than a vulnerability specific to Binance, meaning users of different cryptocurrency applications could face similar risks if their devices are affected.

In a post on X dated November 10, 2026, Binance said:

A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.

Immediate Action Required:
– Delete any apps installed from untrusted sources, such as sideloaded or manually signed IPAs.
– Update iOS and all apps to the latest official versions.
– If you suspect a breach, transfer funds to a new wallet created on a clean device and reset all active login sessions.

Never install unauthorized packages, and keep your software up to date.

— Binance (@binance) November 10, 2026

The post is available at https://x.com/binance/status/2120093246399430770?ref_src=twsrc%5Etfw.

Risk to Cryptocurrency Wallet Security

Wallet applications can store or provide access to highly sensitive credentials. If a malicious app reads files belonging to another application, the exposed data could include seed phrases, private keys and account login information. An attacker who obtains those credentials could potentially gain control of a user’s digital assets. For many cryptocurrency wallets, the seed phrase serves as the primary means of restoring access to funds, making the confidentiality of such files central to safeguarding digital assets.

Binance emphasized that the warning does not describe a Binance login vulnerability. Instead, it concerns Apple’s iOS operating system and could affect users of multiple cryptocurrency applications. A compromised device could expose the information needed to access wallets regardless of whether the funds are held through an exchange, a software wallet or another type of cryptocurrency application. The episode also highlights that wallet security depends on layers beyond any individual app, with the underlying mobile operating system serving as shared infrastructure for the wider industry.

Binance has not identified any confirmed cryptocurrency theft cases resulting from the vulnerability. Its advisory instead urges users to take preventive measures while the iOS-level security concern remains relevant.

Binance’s Recommended Security Measures

The exchange advised iPhone users to review the applications installed on their devices and remove any they do not recognize or trust. This includes applications installed through sideloading or manually signed IPA packages, particularly when their origin is unclear.

Users should also update iOS and all installed applications to the latest official versions available. Binance said the warning does not mean that every affected device has been compromised, but maintaining current software can help address known security weaknesses and reduce exposure to attacks. Users looking for fixes can follow official Apple software updates and announcements from their wallet or exchange providers.

The exchange also cautioned users against installing unauthorized software packages, which may create additional security risks. The recommendations extend beyond the security of cryptocurrency exchanges themselves: if a device is compromised, the device may reveal wallet data required to access digital assets.

What to Do if a Breach Is Suspected

Users who believe their devices may have been infected should transfer their funds to a new wallet created on a clean device, according to Binance. They should also reset or terminate all active login sessions to reduce the risk of unauthorized access.

Binance further advised users to avoid unauthorized packages and keep both their operating systems and applications up to date. The exchange’s guidance focuses on removing potentially untrusted software, updating affected devices and moving funds when compromise is suspected.