Binance warns of an iOS flaw that could expose wallet keys

Exchange Binance warned iPhone owners on Tuesday about a flaw in iOS. Through it, a malicious app can read files belonging to other apps, and with them wallet recovery phrases and private keys. No confirmed thefts via the bug have been reported so far.

What happened

The exchange published the warning on November 10. By its description, a vulnerability called worse_query affects iOS 26.7.1, 27.0.1 and 27.2. It breaks the app isolation that iPhone security rests on.

Binance said the problem sits in iOS itself and is not limited to its own app. Seed phrases, private keys and login data could be exposed. A spokesperson told Cointelegraph the company had found no confirmed case of attackers using the bug to reach wallets or steal funds.

Earlier the same day, SlowMist, a blockchain security firm, flagged the issue. It clarified that a malicious app can read a recovery phrase only if the wallet stores it on the device without encryption.

What is known about the bug and the patch

An iOS researcher using the handle forcequitOS disclosed the flaw on Sunday. They credited a colleague, 0xjohnny, and posted a proof of concept on GitHub for a sandbox escape on iOS 26.0 through 26.7.2 and on 27.2. The author described it as a demo for developers that "isn't useful by itself". The repository calls worse_query the direct successor of an earlier exploit, bad_query.

A sandbox normally keeps a program out of its neighbors' private files. Worse_query, according to the repository, reaches the folder where iOS stores app data. Hence the worry about wallets.

Apple released iOS 27.2.1 and 26.7.3 on Monday, a day after the code appeared on GitHub. The notes for 27.2.1 list fixes for nine vulnerabilities. Among them is an authorization problem in App Intents that let an app reach sensitive user data, plus several Bluetooth and iMessage bugs. Neither worse_query nor the researcher is mentioned.

Cointelegraph asked Apple for comment but had no reply by publication. SlowMist's chief security officer, who posts as 23pds, said in a tweet that iOS 27.2.1 blocks the worse_query sandbox escape along with other threats, and urged people to update. So opinions differ: the exchange calls these versions vulnerable, an expert thinks the patch already works, and Apple has said nothing officially.

What Binance recommends

The exchange asks users to follow a short routine.

• Delete apps installed from untrusted sources, such as sideloaded files or manually signed builds.
• Update iOS and all apps to the latest official versions.
• If a breach is suspected, move funds to a new wallet created on a clean device.
• Reset all active login sessions.

Apple devices have drawn crypto hunters before. This year Google warned about iOS malware aimed at crypto apps on unpatched phones. In August the Dutch national cyber agency said hackers were exploiting a Screen Sharing bug on macOS to plant Monero miners on Macs.

Where the open questions are

At the time of publication Apple is silent, and no thefts through worse_query are confirmed. For people holding large sums, there is the option of keeping keys off the phone, for example on hardware wallets. Updating iOS to 27.2.1 or 26.7.3 costs nothing, so it is worth doing either way.