Binance Warns iOS Flaw Could Expose Wallet Seed Phrases as Apple’s Latest iPhone Patch Stays Silent

Binance warned iPhone users Tuesday that a publicly released iOS flaw could let malicious apps read files stored by other apps, including the seed phrases and private keys that control crypto wallets.

“A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem,” the exchange wrote on X. “This is an iOS-level issue, not unique to Binance.”

Binance told users to delete any apps installed from untrusted sources, such as sideloaded or manually signed IPA files, and to update iOS and every app to the latest official versions. Anyone who suspects a breach should move funds to a new wallet created on a clean device and reset all active login sessions, the exchange said.

Neither Binance nor the researcher behind the flaw has reported any thefts tied to it.

What worse_query does

The bug is a sandbox escape. On iOS, each app is supposed to live in its own container that other apps cannot read. A researcher who posts as forcequitOS released worse_query on GitHub on Nov. 8, calling it “a zero-day sandbox escape for iOS 26 and 27, again.” It succeeds an earlier exploit, bad_query.