Author
Ahmed Barakat
Author
Share
Fact Checked by
CryptoNews Editorial Team
Author
Binance has warned Apple users about a dangerous iOS vulnerability that could expose crypto wallets, private keys, and login credentials. The flaw, called worse_query, allows malicious applications to access files normally isolated inside other apps. Binance warning identifies several affected iOS software versions and urges users to remove untrusted applications immediately.
The vulnerability threatens more than crypto wallets; apps storing sensitive information locally could also expose passwords, authentication data, and personal files. That makes the latest warning particularly concerning for iPhone users who rely on their devices for banking and crypto transactions.
Binance says the problem affects iOS itself rather than its own wallet infrastructure. Users who suspect their devices have been compromised should create new wallets on clean devices and move their funds. The exchange also recommends resetting active login sessions and updating installed software.
Binance Warns A Dangerous iOS Sandbox Escape
The vulnerability exploits Apple’s application sandbox, a security mechanism designed to keep applications separated from one another. Normally, an application cannot freely access another application’s private files. This isolation protects sensitive information even when users install multiple applications on the same device.
This is where it gets dangerous: the worse_query exploit reportedly bypasses those restrictions. A malicious application could potentially access directories containing information belonging to other installed applications.
The researcher behind the public GitHub repository describes worse_query as a sandbox escape affecting iOS 26 and iOS 27. The project identifies affected releases spanning iOS 26.0 through 26.7.2 and iOS 27.2. Binance warns that exposed information could include cryptocurrency recovery phrases, private keys, and login credentials.
The actual danger depends partly on how individual applications store sensitive information. Wallets retaining recovery phrases or other credentials in accessible local files face particular risks.
Security researchers have also highlighted the importance of protecting plaintext wallet information. SlowMist’s security chief warned that the vulnerability could undermine assumptions about isolation between application containers.
Discover: The Best Token Presales
Apple Users Face Questions Over Security Updates
Apple’s security update schedule adds another dimension to the Binance iOS warning. Apple’s security releases list iOS 27.2 and iOS 26.7.2 among its available software versions, both released on October 26, 2026.
However, Apple’s published security advisories do not explicitly identify worse_query by name. There is currently no confirmed public statement establishing that these updates fully resolve the specific sandbox escape.
A separate GitHub project implementing the exploit also reported on November 8 that Apple’s available software releases had not patched worse_query. This leaves users with an important gap between installing the latest available update and confirming that a particular vulnerability has been fixed.
Binance recommends installing the latest official iOS release and keeping all applications updated. It also urges users to remove applications from unknown sources, including manually signed IPA files.
For us, crypto holders, the safest response to suspected compromise goes beyond simply deleting suspicious software.
Previous iPhone Attacks Put Crypto Wallets in the Spotlight
The latest iPhone warning follows several security incidents involving malicious applications and crypto credentials. In September, Binance warned users about FomoPeek, a third-party application whose versions 1.1 and 1.2 reportedly contained malicious code.
Security researchers found that the software could exploit iOS vulnerabilities to obtain elevated device privileges. Potentially exposed information included recovery phrases, private keys, login credentials, and other locally stored data.
More recently, CertiK highlighted the DarkSword exploit framework, which reportedly targeted cryptocurrency applications through compromised websites and vulnerable iPhones.
These incidents involve separate attack methods. Nevertheless, they demonstrate why smartphone security has become increasingly important for crypto holders.
The Binance iOS warning highlights a fundamental problem with self-custody: protecting a recovery phrase means protecting every place where that information might be stored.
Discover: The Crypto Presales This Q4 2026
