Binance warns of an iOS flaw that threatens wallet keys

Binance warned on November 10 that the worse_query security flaw in iOS could let malicious apps read other apps’ files, exposing credentials for crypto wallets. Neither Binance nor the researcher who published it has reported any thefts linked to this flaw, and it remains unclear whether Apple’s latest updates fix it.

How could worse_query expose a wallet’s keys?

worse_query bypasses the isolation between apps, known as the sandbox, allowing access to files that should normally stay separate. Think of each app as an apartment with its own lock: the problem arises when one tenant gains access to the neighbors’ units.

For a crypto wallet, these files may include the seed phrase (recovery phrase), i.e. the words that let you restore it, or private keys, which give control over the funds. Binance stressed that the issue concerns the operating system and not just its own app.

The researcher forcequitOS published the code on GitHub on November 8 as an experimental demonstration of the technique (proof of concept). It isn’t a tool for removing iOS restrictions, known as a jailbreak, nor does it work on its own: it has to be built into an app. Developer Christoph Kolbicz has already presented a file manager that uses it and, according to him, it was tested on iOS 27.0.1.

Are all iPhone wallets at risk?

Exposure depends on the app the user installs and on how the wallet’s secrets are stored. According to blockchain security firm SlowMist, the flaw does not steal assets on its own.

The attack scenario assumes the user installs and runs an untrusted iOS app package, an IPA file, outside the App Store. The malicious app can then search other apps’ storage areas for sensitive data.

SlowMist links this particular risk to wallets that store seed phrases or other sensitive data in readable, unencrypted files. Wallets that don’t write such secrets to plain files aren’t exposed in the same way. Hardware wallets, for their part, keep private keys off the phone.

Do the latest iOS updates fix the problem?

There is no public confirmation that the latest versions block the technique. Apple released iOS 27.2.1 and 26.7.3 on November 9, but the security notes don’t name worse_query or describe a similar app isolation bypass.

There is also a discrepancy in the versions reported as affected. Binance names 26.7.1, 27.0.1 and 27.2, while the researcher’s documentation lists 26.0 through 26.7.2 and 27.2. So the absence of a mention in the updates proves neither a fix nor continued exposure.

What does Binance recommend to iPhone users?

Binance urges users to remove untrusted apps and update iOS and all apps to the latest official versions. Specifically, it recommends:

• Deleting apps from untrusted sources, such as manually signed IPA files.
• If you suspect a compromise, moving your funds to a new wallet created on a clean device.
• Resetting all active login sessions.

The same technical warning applies to crypto holders in Greece. We think the key here is not to confuse a published flaw with a confirmed theft, but also not to confuse installing an update with a proven fix. Being careful about the apps we install remains an essential part of protecting a wallet.