Binance Warns iPhone Flaw Could Expose Crypto Wallet Keys
Binance has warned cryptocurrency users that a publicly documented iOS sandbox flaw could allow a malicious application to read files belonging to other apps, potentially exposing locally stored recovery phrases, private keys and account credentials.
The exchange issued the warning on November 10, identifying iOS 26.7.1, 27.0.1 and 27.2 among versions vulnerable to the technique, known as “worse_query.” Binance stressed that the weakness is in Apple’s operating system rather than its own application and could affect crypto wallets or other software that stores sensitive information locally.
Apple released iOS 27.2.1 and iOS 26.7.3 on November 9. The company’s published security notes for those releases do not identify worse_query by name or assign a confirmed CVE to the issue, leaving some uncertainty over whether the newest updates specifically close the technique described by researchers.
What Does the Worse_Query Flaw Actually Allow?
The public proof of concept for worse_query describes a sandbox escape affecting iOS 26.0 through 26.7.2 and iOS 27 through 27.2. Apple’s sandbox normally isolates each application’s data so one app cannot freely browse files belonging to another.
The proof of concept demonstrates access to directories containing application data, plug-in data, shared app groups and some system containers. That creates a potential path for a hostile application to inspect files that another app assumes are isolated.
For cryptocurrency users, the financial risk depends heavily on how individual wallets store their secrets. A wallet that keeps recovery information or key material in readable local files could be more exposed than one relying on encrypted storage, hardware-backed protection or Apple’s Secure Enclave.
The research does not establish that every wallet is vulnerable, and there is currently no confirmed theft publicly attributed specifically to worse_query. The repository also describes the code as a developer proof of concept rather than a jailbreak or ready-made wallet-stealing tool.
Investor Takeaway
The vulnerability is more serious for self-custody users because possession of a seed phrase or private key can give an attacker direct control over assets. Unlike an exchange password, compromised wallet credentials generally cannot simply be reset after funds are transferred.
Do Apple’s Latest Updates Fix the Problem?
Apple’s November 9 security releases address several vulnerabilities, including issues affecting sensitive user data, Bluetooth and system components. However, neither the iOS 27.2.1 nor iOS 26.7.3 advisory explicitly refers to worse_query.
The public worse_query repository currently lists affected releases only through iOS 26.7.2 and iOS 27.2, which stops immediately before Apple’s latest stable updates. That may indicate the technique no longer works on the newest versions, but Apple has not publicly confirmed that interpretation in its security documentation.
Binance advised users to install the latest official iOS version and update their applications, while removing software downloaded from untrusted sources. The risk is particularly relevant to sideloaded or manually signed applications because exploitation requires malicious code to be running on the device.
The warning adds to a series of recent concerns around Apple devices and crypto custody. FinanceFeeds recently reported that older iPhones may carry hardware-level vulnerabilities that cannot be fixed through ordinary software updates, although exploiting those weaknesses does not automatically reveal wallet credentials.
Investor Takeaway
Updating iOS reduces exposure, but the absence of an Apple advisory explicitly naming worse_query means users should not treat the update alone as proof that every variant of the technique has been eliminated.
Why Are Crypto Wallets a High-Value Target on Apple Devices?
Crypto holders have repeatedly been targeted through malicious applications because wallet recovery phrases provide a direct route to assets without requiring access to a bank or exchange account.
Earlier this year, Apple removed a fraudulent Ledger application linked to about $9.5 million in cryptocurrency theft. That case relied on users entering their recovery phrases into a fake application rather than a sandbox escape, but it showed the financial value attackers place on credentials stored or entered on consumer devices.
FinanceFeeds also covered a previous Trust Wallet warning involving an iOS zero-day threat, adding to concerns about how operating-system vulnerabilities can affect self-custody even when the wallet application itself is not the initial point of compromise.
Binance said users who believe a malicious application may already have accessed their device should create a new wallet on a clean device and move their assets rather than relying only on deleting the suspicious app. They should also terminate active sessions and replace any potentially exposed login credentials.
Investor Takeaway
The incident reinforces a structural difference between crypto custody and conventional accounts: device security can become asset security. If a private key is copied before an operating-system flaw is patched, fixing the device does not invalidate the stolen credential.