Binance Flags iOS Flaw That Could Expose iPhone Users’ Crypto Wallets and Private Keys
Key Takeaways:
- Binance warns users that iOS has a vulnerability called ‘worse_query’ that might leave other apps’ files exposed.
- Owned devices could possibly be vulnerable to losing seed phrases, private keys, and logins.
- Users should remove apps that they believe are untrusted, update their software, and withdraw any funds to a new wallet if they suspect a breach.
User Score
8.7
A security flaw in Apple’s iOS operating system could potentially lead to the leakage of sensitive data from apps, including cryptocurrency wallets, according to Binance. The exchange states the problem is called “worse_query”, and it occurs across several different iOS versions and may enable malicious applications to access local files belonging to other apps.
A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.
Immediate Action Required:
– Delete any apps installed from untrusted sources (such as sideloaded or manually signed IPAs).
– Update iOS and all apps to the latest official versions.
– If you suspect a breach, transfer funds to a new wallet created on a clean device and reset all active login sessions.Never install unauthorized packages, and keep your software up to date.
— Binance (@binance) November 10, 2026
Binance Identifies Risk to Crypto Wallet Security
Binance has warned that the flaw applies to iOS versions 26.7.1, 27.0.1 and 27.2. It could also enable a malicious application to access locally stored data from other servers, thus exposing information that users might want to keep confidential.
The concern for the crypto owners is that wallet apps can be done or consist of watching to delicate credentials. That includes seed phrases, private keys, and some type of account log in info. Attackers who get a hold of this can possibly control the digital assets of a user.
Binance said this is not a Binance login vulnerability, but a problem in Apple’s operating system. Thus, if they are impacted, users employing different kinds of cryptocurrency applications might be subjected to similar dangers.
Read More: Binance Reveals How Hackers Moved $6.34B After Breaching Its Wallet-Signing System
Binance Recommends Immediate Security Measures
The exchange recommended that users of iPhones screen the apps installed and delete any others they are not familiar with. That means applications that have been sideloaded or manually signed IPA packages, especially if they are not clear of their origin.
Users should also ensure that both iOS and apps are on the latest official versions that are available. Binance’s caution is not intended to prove that all impacted devices have been hacked, but it likely means that keeping software current can minimize vulnerabilities to known attacks that are posing a risk.
What Crypto Holders Should Do if a Breach Is Suspected
Binance advises those who feel their devices might have been infected to move their balances over to a fresh wallet that has been built on a clean gadget. They should also have the capability to terminate or invalidate active logon sessions to minimize the potential of unauthorized logon.
The exchange also warned its users of the danger of installing non-authorized software packages that could pose extra threats to security.
The warning highlights the importance of protecting wallet credentials beyond the security of cryptocurrency exchanges themselves. No matter how funds are stored, compromised devices can reveal the data that is required to access them.
Binance has not identified any confirmed cryptocurrency theft cases, though due to vulnerability. Instead, its advisory encourages users to take preventive action, as the iOS-level security concern continues.
Read More: Binance Replenishes 98% of $6.34B Hack Losses, Expands Proof of Reserves to 44 Tokens
This story was originally published by CryptoNinjas. Read the original article.
