Binance issued a security warning on November 10 about an iPhone vulnerability called worse_query. The flaw could expose crypto wallet recovery phrases, private keys and login credentials stored in accessible files. The exchange named iOS 26.7.1, iOS 27.0.1 and iOS 27.2 among the affected versions and urged users to remove apps installed from untrusted sources. Binance described it as an issue in iOS itself and did not report any theft tied to the flaw.
What is worse_query, and how could it affect a wallet?
iOS normally gives each app its own private storage area, called a sandbox. Your weather app, for example, shouldn’t be able to open files stored by your crypto wallet. The developer who published the worse_query proof of concept showed that an app can bypass some of those restrictions and reach folders that belong to other apps. The scenario Binance warned about involves running a malicious app on the phone.
What an attacker could actually retrieve depends on how each wallet stores its secrets. A recovery phrase saved in a readable file is directly exposed if the app can reach it. Reading an app’s files does not, by itself, demonstrate that the attacker can decrypt protected data or extract items from Apple’s Keychain. If an attacker does get a recovery phrase, though, they can restore the wallet elsewhere. Changing the wallet app’s PIN won’t stop them.
Does iOS 27.2.1 fix it?
Apple released iOS 27.2.1 and iOS 26.7.3 on November 9. Neither security advisory explicitly identifies worse_query. SlowMist security chief 23pds said iOS 27.2.1 blocks the flaw, but the maintainers of Erosion, a tool that uses the same sandbox escape, list 27.2.1 as supported. With those accounts conflicting, install the latest official update your phone offers, but don’t rely on the update alone to address this specific risk.
What iPhone users should do now
- Update iOS and your apps. Open Settings → General → Software Update to check what’s available for your iPhone.
- Remove apps you installed from sources you don’t trust. Binance singled out sideloaded and manually signed
.ipafiles, the packages used to install iPhone apps. Avoid installing wallet builds sent through chats or hosted on unfamiliar download sites. - If you suspect a self-custody wallet key was exposed, create a wallet with a fresh recovery phrase on a separate, trusted device. Follow your wallet provider’s guidance for moving any remaining assets. Reusing the old recovery phrase carries the same risk to the new device.
- If you suspect an exchange login was exposed, secure the account from a trusted device. Change the password, revoke unrecognised sessions and review recent activity. If you see unauthorised withdrawals or logins, contact the exchange through its official support channel.
