Binance warns iPhone crypto holders about unpatched iOS flaw

Binance urged iPhone users who hold cryptocurrency to take precautions after researchers disclosed a flaw that can expose data stored by other apps. The company and security researchers disagree on whether Apple has patched the issue.

Binance warned iPhone users on Nov. 11 that an iOS vulnerability could let malicious apps read sensitive data from other apps, including cryptocurrency seed phrases, private keys and login credentials.

What Binance and researchers reported

Binance identified the flaw as worse_query and said it affects iOS 26.7.1, iOS 27.0.1 and iOS 27.2. The company urged users to delete apps installed from untrusted sources, including sideloaded or signed IPA files, update iOS and all apps, move funds to a new wallet created on a clean device if they suspect a breach, and reset active login sessions.

Security researchers @0xjohnny and @forcequitOS disclosed the vulnerability and published a proof of concept on GitHub. Their demonstration shows how the flaw can bypass iOS sandbox protections that block apps from accessing files owned by other apps.

Patch status remains unclear

A Community Note on Binance's post described worse_query as an unpatched zero-day. @forcequitOS said neither iOS 27.2.1 nor iOS 27.3 beta 1 fixes the vulnerability. Apple has not listed a fix in its recent security updates, including iOS 27.2.1.