Binance Warns of iOS Vulnerability Threatening Crypto Wallet Data

On November 10, 2026, the cryptocurrency exchange Binance warned iPhone owners about the worse_query vulnerability in the iOS operating system. This vulnerability allows applications to bypass standard restrictions on accessing files of other programs. Under certain conditions, this could lead to the exposure of seed phrases, private keys, and login data for cryptocurrency services.

The issue is related to the protection mechanisms of iOS itself, potentially affecting not only the Binance app but also other programs installed on the device. However, the mere existence of the vulnerability does not mean that user data has already been stolen. As of the time of publication, there have been no confirmed cases of cryptocurrency theft specifically using worse_query.

How the worse_query vulnerability works

iOS uses an application isolation mechanism known as sandboxing. It restricts each program's access to its own files and prevents reading data from other applications without appropriate permissions. The worse_query vulnerability allows bypassing some of these restrictions and accessing directories that are usually inaccessible to third-party software.

Researchers published demonstration code on GitHub on November 8. According to their description, the method works on iOS versions 26.0–26.7.2. Independent developers have also reported its use in iOS 27.0–27.2. However, the authors emphasize that this is a demonstration of bypassing application isolation, not a full system hack with all privileges obtained.

For cryptocurrency wallet owners, the danger lies in the potential access to confidential data that applications store locally. If a seed phrase, private key, or account credentials are in a file accessible through the vulnerability, a malicious program may attempt to read them. However, information protected by other mechanisms does not necessarily become accessible, so claiming the automatic theft of any keys is incorrect.

Has the vulnerability been fixed?

On November 9, Apple released iOS updates 26.7.3 and 27.2.1, addressing several security issues. However, the published descriptions of these versions do not explicitly mention the worse_query vulnerability. At the time of preparing this material, Apple has not confirmed that the new updates specifically address this method of bypassing application isolation.

Despite the uncertainty regarding the fix status, Binance recommends installing the latest official iOS and app updates. The exchange also urged users to avoid programs downloaded from unreliable sources, including IPA files manually installed bypassing standard application distribution mechanisms. Such programs could be used to run malicious code on the device.

IPA is the installation package format for iOS applications. This format is not inherently malicious, but installing programs from unknown sources increases the risk of running software that has not undergone proper verification.

What should cryptocurrency wallet owners do?

If a user suspects that a malicious application was running on their iPhone, Binance recommends checking installed programs and removing those that cannot be trusted. The system and applications should also be updated through official sources. If there is suspicion of credential leakage, active sessions should be terminated, and the corresponding passwords changed from a trusted device.

For non-custodial cryptocurrency wallets, the consequences of a seed phrase exposure can be more severe than a regular password leak. With this phrase, an attacker can restore access to assets on another device. Therefore, if there is a justified suspicion of its compromise, it is recommended to create a new wallet on a clean device and transfer the funds there.

It remains unknown whether worse_query has been used for real attacks on cryptocurrency users. The published demonstration code shows the technical possibility of bypassing some iOS restrictions but does not confirm mass thefts of seed phrases or private keys.