TLDR
- Binance warned on November 10 that an iOS flaw called worse_query could let a malicious app read other apps’ files.
- Binance listed iOS 26.7.1, 27.0.1 and 27.2 as vulnerable.
- Apple released iOS 27.2.1 and 26.7.3 on November 9, but its notes do not name worse_query.
- No thefts or attacks tied to the flaw have been reported.
- Binance says users who suspect a bad app should move funds to a new wallet on a clean device.
Binance has warned iPhone users about an iOS flaw that could let a malicious app read files from other apps. The exchange issued the alert on November 10.
A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.…
— Binance (@binance) November 10, 2026
The flaw is called worse_query. Binance said the weakness sits in Apple’s operating system and not in its own app.
Binance named iOS versions 26.7.1, 27.0.1 and 27.2 as vulnerable. Apple released iOS 27.2.1 and iOS 26.7.3 on November 9.
What Apple’s update notes say
Apple’s security notes for the two updates do not mention worse_query by name. They also do not list a confirmed CVE for the problem.
The public code lists affected versions only up to iOS 26.7.2 and iOS 27.2. That stops just before Apple’s newest releases.
This may mean the method no longer works on the new versions. Apple has not confirmed that in its documentation.
A researcher described the flaw as a sandbox escape. A sandbox normally keeps each app’s data apart from other apps.
The public proof of concept shows access to folders that hold app data, plugin data and shared app groups. It also reaches some system containers.
According to The Hacker News, the published code needs extra setup to work. The repository calls it a proof of concept for developers, not a jailbreak or a wallet-stealing tool.
The risk to crypto users depends on how a wallet stores its secrets. Readable local files may be more exposed than encrypted storage or Apple’s Secure Enclave.
What Binance told users to do
Binance advised users to install the latest official iOS version and update their apps. It also told them to remove software from untrusted sources.
The exploit needs malicious code to run on the device. That makes sideloaded or manually signed apps a particular concern.
Users who think a bad app already reached their phone should create a new wallet on a clean device and move their assets. Binance said they should also end active sessions and replace login details.
Deleting the suspicious app alone is not enough, according to the exchange. Recovery phrases and private keys can give an attacker direct control of funds.
Neither Binance nor the researcher has reported attacks or thefts tied to the flaw. No specific wallet app has been named as exposed.
The warning comes days after Binance disclosed a separate cyberattack on October 29. It affected about $6.34 billion in digital assets, according to TheStreet.
That attack involved compromised employee computers. The attackers reached an internal wallet-signing service and started unauthorized transactions.
Binance said it would absorb the loss. As of its November 3 report, about $2.85 billion in assets had been frozen or intercepted, subject to reconciliation and market price changes.
