Binance has issued a security warning to Apple users about a serious iOS vulnerability that could put cryptocurrency wallets, private keys, and account credentials at risk. The flaw, identified as worse_query, reportedly enables malicious applications to access files that should remain protected within other apps. Binance has highlighted multiple affected iOS versions and advised users to immediately uninstall applications they do not trust.
The potential exposure extends beyond cryptocurrency wallets. Applications that store sensitive information directly on an iPhone could also leak passwords, authentication details, and personal files. This creates additional concerns for users who depend on their devices for financial services, banking, and crypto transactions.
The vulnerability targets Apple’s application sandbox, a security feature designed to prevent applications from accessing one another’s private data. Under normal circumstances, each application operates within an isolated environment, restricting unauthorized access to files stored by other apps.
However, the worse_query exploit reportedly circumvents these security protections. This could allow a malicious application to enter directories containing sensitive information associated with other installed applications.
According to the researcher behind the public GitHub repository, worse_query is a sandbox escape vulnerability affecting iOS 26 and iOS 27. The project lists impacted software releases ranging from iOS 26.0 through 26.7.2 and iOS 27.2. Binance cautions that potentially exposed information includes wallet recovery phrases, private keys, and account login credentials.
The level of exposure may vary depending on how individual applications handle sensitive data. Cryptocurrency wallets that retain recovery phrases, passwords, or other authentication details in locally accessible files could face greater risks.
Security experts have also emphasized the dangers of storing wallet credentials in unencrypted formats. SlowMist’s security chief warned that the vulnerability could challenge the security assumptions surrounding isolation between application containers.
Apple Users Question Whether the Latest iOS Updates Fix the Vulnerability
Apple’s software update timeline has added further uncertainty to the Binance security warning. The company’s security release records list iOS 27.2 and iOS 26.7.2 among the available versions, both released on October 26, 2026.
However, Apple’s official security advisories do not specifically mention the worse_query vulnerability. As a result, there is no publicly confirmed statement establishing whether these updates completely eliminate the reported sandbox escape.
A separate GitHub project demonstrating the exploit also claimed on November 8 that Apple’s available software releases had not addressed worse_query. This creates uncertainty for users who have installed the newest iOS version but cannot independently confirm whether the particular security weakness has been resolved.
Binance advises iPhone owners to install the latest official iOS software and regularly update their applications. The exchange also recommends removing software obtained from unfamiliar sources, particularly manually signed IPA files.
For cryptocurrency holders, responding to a possible security compromise requires more than simply deleting suspicious applications. Users should also consider whether sensitive wallet information may already have been exposed and take appropriate steps to protect their assets.
Previous iPhone Security Incidents Raise Concerns Over Crypto Wallets
The latest Binance warning follows several incidents involving malicious iPhone applications and cryptocurrency credentials.
In September, Binance alerted users to FomoPeek, a third-party application whose versions 1.1 and 1.2 reportedly included malicious code. Security researchers discovered that the software could take advantage of iOS vulnerabilities to obtain elevated privileges on affected devices.
The potentially compromised information included cryptocurrency recovery phrases, private keys, account credentials, and other sensitive files stored locally.
More recently, CertiK drew attention to the DarkSword exploit framework, which reportedly targeted cryptocurrency applications through compromised websites and vulnerable iPhones.
Although these security incidents rely on different attack techniques, they highlight the growing risks facing cryptocurrency users who depend on smartphones to manage their digital assets.
Ultimately, the worse_query warning reinforces an important principle of cryptocurrency self-custody: protecting a recovery phrase requires securing every location where that information is stored, not just the wallet application itself.
About The Author
More Stories
US CPI Inflation Hits 0.4% in October, Exceeding Market Expectations
Bitcoin Trails Stock Market Recovery Ahead of Key U.S. Inflation Data
Bitcoin Dips Ahead of U.S. Inflation Data as Fed Rate Hike Bets Grow