Binance has alerted Apple users to a potentially serious iOS security flaw that could put cryptocurrency wallets, private keys, and sensitive login information at risk. The vulnerability, named worse_query, reportedly enables malicious applications to bypass normal restrictions and retrieve files belonging to other installed apps. In response, Binance has identified affected iOS versions and urged users to remove software from unverified sources.
The threat extends beyond cryptocurrency applications. Other apps containing locally stored passwords, authentication records, and personal documents could also be exposed. This raises broader security concerns for iPhone owners who use their devices for banking, financial management, and cryptocurrency transactions.
At the center of the issue is Apple’s application sandbox, a security mechanism that keeps applications isolated from one another. This system is designed to prevent one app from accessing another’s private files without permission, reducing the possibility of unauthorized data collection.
However, the worse_query exploit reportedly bypasses these restrictions, potentially allowing harmful applications to access directories that should remain protected. This could create opportunities for attackers to retrieve confidential information from multiple applications installed on the same device.
The researcher behind the public GitHub project describes worse_query as a sandbox escape affecting Apple’s iOS 26 and iOS 27 software. The documented affected releases include versions ranging from iOS 26.0 through 26.7.2, as well as iOS 27.2.
Binance specifically warns that exposed data could include cryptocurrency seed phrases, private keys, and account credentials. Such information could give attackers access to users’ digital assets if it is obtained and successfully exploited.
The actual risk depends on how individual applications handle sensitive information. Wallet applications that retain recovery phrases or authentication details in locally accessible files could face greater exposure.
SlowMist’s security chief has also highlighted concerns about the vulnerability, suggesting that it could weaken the security guarantees provided by Apple’s application isolation system.
Binance Raises Concerns Over Apple’s iOS Security Updates
Apple’s latest software releases have added uncertainty to the situation. According to the company’s security release records, iOS 27.2 and iOS 26.7.2 were both made available on October 26, 2026.
However, Apple’s official security advisories do not explicitly mention the worse_query exploit. Therefore, users currently lack clear public confirmation that these releases completely resolve the reported vulnerability.
A separate GitHub project associated with the exploit claimed on November 8 that Apple’s available software updates had not addressed the issue. This leaves uncertainty over whether updating to the latest iOS version provides complete protection against this specific attack.
Binance recommends installing the newest official iOS software and keeping applications updated. It also advises users to delete applications obtained from unfamiliar sources, including manually signed IPA files.
For cryptocurrency holders, the precautions may need to go further if a device has potentially been compromised. Simply removing suspicious software might not be sufficient if recovery phrases or private keys have already been exposed. Protecting wallet credentials and securing potentially affected accounts should remain a priority.
Previous iPhone Security Threats Targeted Crypto Users
The latest Binance alert follows several other incidents involving malicious applications and attempts to access cryptocurrency credentials.
In September, Binance warned about FomoPeek, a third-party application whose versions 1.1 and 1.2 reportedly contained harmful code. Security researchers discovered that the application could exploit iOS vulnerabilities to obtain elevated privileges on affected devices.
The potentially exposed information included wallet recovery phrases, private keys, account passwords, and other sensitive files stored on iPhones.
More recently, CertiK highlighted the DarkSword exploit framework, which reportedly targeted cryptocurrency applications through compromised websites and vulnerable Apple devices.
Although these incidents involve different exploitation techniques, they demonstrate the growing security challenges facing cryptocurrency investors who depend on smartphones to manage their holdings.
Ultimately, the worse_query vulnerability highlights a major responsibility associated with crypto self-custody. Securing digital assets requires protecting not only the wallet application but also every location where recovery phrases, private keys, and other confidential credentials are stored.
