Binance has warned iPhone users that a newly disclosed iOS vulnerability could allow malicious applications to access cryptocurrency wallet recovery phrases, private keys and login credentials stored by other apps, potentially exposing digital assets to theft.
In a November 10, 2026 security alert, the cryptocurrency exchange identified iOS 26.7.1, 27.0.1 and 27.2 among versions affected by the vulnerability, known as worse_query. Binance said the issue originates in Apple’s operating system rather than its own trading platform and could affect users across the cryptocurrency ecosystem.
The warning follows the public release of a proof-of-concept demonstrating access to normally restricted application files. Apple issued new iOS security updates on November 9, although its published advisories do not explicitly identify worse_query or confirm whether the vulnerability has been fixed.
Worse_query allows access to other iOS applications
The vulnerability targets Apple’s application sandbox, which ordinarily prevents one app from accessing another app’s private files without authorisation.
Security researcher forcequitOS published worse_query on GitHub, describing it as a successor to an earlier sandbox escape called bad_query. The proof-of-concept supports multiple versions of iOS 26 and 27, including iOS 26.0 through 26.7.2 and iOS 27.2.
According to the research documentation, an application using the technique can access directories belonging to other installed applications, app extensions, internal system daemons and shared application groups. Some system-level directories are also accessible on iOS 27.
That is quite a lot of access for an otherwise ordinary-looking app.
The researcher specifies that the technique requires an application configured with an App Group container and is not a jailbreak. The published proof-of-concept demonstrates a way to cross application file-access boundaries, rather than a complete attack designed to steal cryptocurrency.
Binance warned that malicious apps exploiting this weakness could potentially retrieve sensitive information stored in accessible local files, including recovery phrases and authentication credentials.
The warning is broad, and intentionally so.
For cryptocurrency users, the actual exposure depends on how individual wallet applications protect their secrets. Encrypted wallet databases, hardware-backed keys and credentials stored outside accessible application files do not all face the same risk. Access to another app’s files does not automatically establish that an attacker can decrypt its private keys.
Apple updates leave questions about the vulnerability
Apple released iOS 27.2.1 and iOS 26.7.3 on November 9, one day before Binance’s security warning.
According to Apple’s official iOS 27.2.1 security advisory, the update addresses several vulnerabilities involving Bluetooth, AirPlay, Messages and App Intents.
Among the fixes is CVE-2026-113963, an App Intents authorisation flaw that Apple says could allow an application to access sensitive user data. The advisory does not associate that vulnerability with worse_query or identify the researchers behind the sandbox escape.
The timing is a little awkward here.
Documentation for Erosion, an iOS customisation tool built using worse_query, now lists iOS 27.2.1 among its supported versions. That developer claim suggests the November 9 update may not have eliminated the technique on every affected device, although independent testing of the latest release was not established during this review.
Erosion’s documentation lists support for iOS 26 through 26.7.2, without extending that range to iOS 26.7.3. The omission does not independently establish that the newer release blocks the vulnerability.
Apple has not publicly identified a specific worse_query patch in either advisory. Users are therefore being encouraged to update their devices while the effectiveness of those releases against this particular technique remains uncertain.
Private-key exposure does not automatically mean wallet theft
The consequences of unauthorised file access depend heavily on what information an affected application stores and whether an attacker can use it to authorise transactions.
A cryptocurrency recovery phrase can allow someone to reconstruct a wallet and control the associated funds. A stolen exchange login credential, by comparison, may still be subject to additional authentication and withdrawal protections.
A private key retained in encrypted storage may require further access before it becomes usable. A recovery phrase saved as an unencrypted document or screenshot creates a different exposure.
DaveFinances previously examined how DarkSword spyware can expose cryptocurrency wallets on iPhones. That exploit framework involved a seperate chain of vulnerabilities and documented attempts to collect wallet-related information from compromised devices.
The two cases involve different techniques, even though the possible outcome for a wallet holder looks much the same.
There is also a distinction between exposing application data and gaining control of the private keys used to sign transactions. DaveFinances has previously explored how malicious browser extensions can compromise cryptocurrency wallet credentials, including cases involving counterfeit software and compromised legitimate releases.
The financial consequences of actual key exposure were illustrated by the recent Keplr wallet attack involving approximately $6 million in stolen assets. That incident involved a vulnerability in Web3Auth infrastructure affecting certain social-login wallets, not the newly disclosed iOS sandbox weakness.
Neither the worse_query proof-of-concept nor Binance’s November 10 warning establishes that the vulnerability has already been exploited to drain cryptocurrency wallets. No verified loss figure or affected-wallet count has been attributed to worse_query.
Binance advises wallet migration after suspected compromise
Binance urged iPhone users to remove applications installed from untrusted sources, particularly sideloaded apps and manually signed IPA files, and install the latest official iOS and application updates.
For users who suspect their device has already been compromised, the exchange recommended creating a new wallet on a clean device, transferring funds to its newly generated addresses and resetting active login sessions.
Moving funds to a wallet derived from the same potentially exposed recovery phrase would not remove the risk. An attacker who already possesses that phrase could still reconstruct the original wallet and access any accounts controlled by it.
And deleting the suspicious app alone may not be enough, not if the credentials were already copied.
The relevent response also depends on the type of wallet. Users holding assets through a custodial exchange account may need to secure their credentials and authentication methods, while self-custody users with potentially exposed signing keys may need to replace the underlying wallet credentials entirely.
For investors using hardware wallets, a vulnerability in an accompanying iPhone application does not automatically expose private keys that remain isolated inside a dedicated signing device. Recovery phrases copied onto the phone, however, could undermine that separation.
The public release of worse_query gives researchers and application developers a reproducible technique for examining file-access protections across affected iOS versions. It also makes the underlying method availble to potential attackers.
For now, the confirmed development is a publicly documented sandbox escape and an exchange-wide security warning, rather than a verified cryptocurrency theft campaign. Whether Apple’s latest updates fully prevent the technique, and whether malicious applications have already exploited it against wallet users, remain unresolved.
Johan Shamshad is Editor-in-Chief at Dave Finances, covering financial markets, digital assets, trading platforms, brokers, fintech, payments and regulation. Since 2023, he has also worked as an editor at Gulf News, the UAE English-language newspaper published by Al Nisr Publishing LLC. His work focuses on market-moving developments, company disclosures, regulatory changes and trading infrastructure, with an emphasis on primary-source verification and practical context for traders and investors.