Binance Warns of Apple iOS Flaw That Could Expose iPhone Users' Private Keys

In brief

• Binance warned that an iOS vulnerability dubbed "worse_query" could let malicious apps read other apps' files, exposing seed phrases, private keys and logins.
• The exchange said the flaw affects iOS 26.7.1, 27.0.1 and 27.2, and urged users to delete sideloaded apps and update their devices.
• Apple released iOS 27.2.1 on Monday, but its security notes do not mention worse_query or confirm whether the update fixes it.

Binance has warned iPhone users about a vulnerability in Apple's iOS that it says could let malicious apps read files stored by other apps, putting crypto wallet seed phrases, private keys and login credentials at risk.

The flaw, dubbed "worse_query," affects iOS 26.7.1, 27.0.1 and 27.2, the exchange tweeted on Tuesday. "This is an iOS-level issue, not unique to Binance," it said.

Binance urged users to delete any apps installed from untrusted sources, such as sideloaded or manually signed app files, and to update iOS and all apps to the latest official versions. Anyone who suspects a breach should move their funds to a new wallet created on a clean device and reset all active login sessions, it said.

iPhone apps normally run inside a sandbox, which stops them from accessing other apps' private files. A researcher who goes by forcequitOS published worse_query on GitHub as a sandbox escape for iOS 26.0 through 26.7.2 and iOS 27.2, describing it as a proof of concept for developers that "isn't useful by itself." Among the locations it can reach is the folder where iOS apps store their data, according to the repository, which calls it the "direct successor" to an earlier exploit, bad_query. There have been no confirmed reports of crypto being stolen using the flaw.