Binance Flags iOS Flaw That Could Expose Crypto Wallet Keys Across Ecosystem

TL;DR

• Binance warned that the worse_query vulnerability affecting iOS 26.7.1, 27.0.1 and 27.2 could let malicious apps read local files from other applications, exposing wallet credentials.
• The exchange said seed phrases, private keys and login information may be at risk, emphasizing that the issue exists at the iOS level.
• Binance advised removing untrusted apps, updating software and moving funds to a new wallet on a clean device if compromise is suspected.

Binance has warned iPhone users about an iOS vulnerability called worse_query that could allow malicious applications to read local files belonging to other apps. In an official security alert, the exchange listed iOS 26.7.1, 27.0.1 and 27.2 among affected versions and said seed phrases, private keys and login credentials could be exposed. The risk sits at the operating-system level rather than inside Binance’s wallet infrastructure. Binance framed the notice as an ecosystem-wide precaution for affected iOS wallet users. The warning is especially relevant for users who keep sensitive private keys or recovery information on mobile devices.

A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.…

— Binance (@binance) November 10, 2026

Malicious Apps Could Cross iOS Sandbox Boundaries

The flaw involves Apple’s application sandbox, which normally prevents one app from freely reading another app’s private files. Binance said a malicious application on an affected device could bypass that isolation and reach locally stored information. The threat depends on a hostile app being present on the device, not simply on owning an affected iPhone. Binance urged users to remove software installed from untrusted sources, including sideloaded or manually signed IPA files, echoing broader concerns around mobile wallet attack surfaces.

Binance also advised users to update iOS and all installed apps to the latest official versions. However, the reference material said it remained unclear whether Apple’s newest updates specifically patched worse_query. Users who suspect compromise were told to create a new wallet on a clean device, transfer funds and reset active login sessions. That response reflects the severity of potential key exposure: once a seed phrase or private key is copied, changing an app password does not revoke control of the underlying wallet. The warning adds to recent attention around crypto wallet security controls.

A Binance spokesperson said no confirmed cases had been identified in which attackers used this bug to access cryptocurrency wallets or steal funds. The disclosure therefore describes a potentially serious exposure path rather than a confirmed ecosystem-wide theft campaign. The absence of verified losses does not remove the need to treat locally stored wallet secrets as sensitive while the vulnerability remains under scrutiny. The episode reinforces a broader security distinction between wallet software and the device hosting it: even a correctly designed wallet can face risk when operating-system isolation fails. For users managing significant balances, the alert adds another reason to minimize locally exposed credentials and follow private-key compromise safeguards.