Binance Warns of an Unpatched iOS Flaw That Can Read Crypto Wallet Seed Phrases

Binance told iPhone users on Tuesday that a flaw in Apple's operating system, not in any wallet app, could let a malicious app read the private files of other apps on the same device, including seed phrases.

A FLAW CALLED WORSE_QUERY

Binance warned about a vulnerability in Apple's iOS 26.7.1, 27.0.1, and 27.2 that could allow third-party apps to read private files stored by other apps, including cryptocurrency seed phrases, secret keys, and login credentials. The flaw has been dubbed worse_query, and according to Binance's advisory, it affects iOS versions 26.7.1, 27.0.1 and 27.2, covering both iPhones and iPads.

A researcher who posts as forcequitOS released worse_query on GitHub on November 8, calling it "a zero-day sandbox escape for iOS 26 and 27, again." It succeeds an earlier exploit, bad_query. The researcher describes it as a proof-of-concept for developers that isn't useful by itself and stresses it is not a jailbreak, though its documented reach includes other apps' data containers and shared app group folders. Blockchain security firm SlowMist called worse_query a container sandbox escape rather than a jailbreak. A day after the release, developer Christoph Kolbicz published a file manager built on worse_query that lets users browse and edit app data on iOS 27 without jailbreaking.

APPLE'S PATCH MAY NOT BE THE FIX

Apple released iOS security updates on November 9, iOS 27.2.1, 26.7.3, and 18.7.12, that address nine flaws, one of which, tracked as CVE-2026-113963, could allow an app to access sensitive user data. It is unclear whether this is the same issue Binance is warning about, since the CVE-2026-113963 problem was reported by a researcher named László Várady, who found that the access occurred through App Intents rather than App Group containers.

Apple's iOS 27.2.1 security notes do not name worse_query, so a patch for it is unconfirmed, and SlowMist has urged users to install Apple's fix as soon as one arrives. Until Apple confirms otherwise, the safest assumption is that the hole Binance is warning about is still open.

WHAT TO DO RIGHT NOW

The advisory was endorsed by Binance co-founder Yi He, the exchange's co-CEO and longtime partner of founder Changpeng Zhao, and by Charles Guillemet. The exchange said there were no confirmed incidents of attackers using the vulnerability to compromise crypto wallets as of the warning.

Binance's advice is straightforward. Delete any app of questionable origin, since the attack requires a malicious app already on the device. Update only through Apple's official process, never through third-party tools or links. If compromise is suspected, create a new wallet on a clean device, since moving funds to a freshly generated seed phrase removes the value of one that may have already been read.

The flaw does not touch a hardware wallet that requires a physical signature, and it does not touch a seed phrase that only exists on paper. The exposure sits entirely with wallets that store secrets inside an iPhone app, which is exactly the population Binance's warning is aimed at.

This story comes from the Simply Bitcoin Live show. Watch the full episode.