Binance has warned iPhone users about an iOS vulnerability called worse_query. It lets a malicious app read files that belong to other apps. The exchange says the flaw affects iOS 26.7.1, 27.0.1 and 27.2, and that seed phrases, private keys and login credentials could be at risk. Apple released iOS 27.2.1 on Nov. 9.
What the flaw does
Binance stressed that this is not a problem with its own app.
"This is an iOS-level issue, not unique to Binance," the exchange wrote on X.
A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.…
— Binance (@binance) November 10, 2026
SlowMist's chief information security officer, who posts as 23pds, described worse_query as a container sandbox escape and not a jailbreak. It can break the assumption that apps cannot see each other. The flaw does not steal assets by itself. The real trigger is a user installing an IPA file of unknown origin, after which the app can read other apps' containers. A wallet that stores mnemonic phrases, keystores or WebView caches locally in plaintext is exposed to that kind of read.
🚨 SlowMist TI Alert: iOS sandbox escape 0day PoC “worse_query” disclosed 🚨
— SlowMist (@SlowMist_Team) November 10, 2026
A public PoC for a sandbox escape 0day, worse_query, targets iOS 26.0–26.7.2 and iOS 27.2. It is the successor to bad_query. 📱
⚠️ This is a container sandbox escape, not a jailbreak. It breaks the… https://t.co/zwnUpdktYS
That distinction matters. The existence of worse_query does not show that every wallet stores credentials this way, and the available research does not identify a confirmed compromise of MetaMask, Phantom or Trust Wallet. The published material also does not establish that the flaw has been used to steal crypto.
What Binance tells users to do
The exchange asked users to delete any apps installed from untrusted sources, such as sideloaded or manually signed IPAs. It also asked them to update iOS and all apps to the latest official versions. Anyone who suspects a breach should move funds to a new wallet created on a clean device and reset all active login sessions. "Never install unauthorized packages," Binance added.
Sideloading means installing an app from outside Apple's App Store. Those apps skip the store's review, so they are a common route for malware. A hardware wallet adds a layer of protection because the keys stay on a separate device and never sit in a phone's storage.
Apple's patch
Apple released iOS 27.2.1, iPadOS 27.2.1 and macOS 27.2.1, which fix an iMessage flaw that let attackers join group chats, along with issues in AirPlay and Bluetooth. According to SlowMist's 23pds, the upgrade also protects against the DarkSword attack, a malicious PDF memory corruption bug tracked as CVE-2026-112611, and the worse_query sandbox escape on iOS 27.2.
Users on the affected versions can update in Settings under General and Software Update. The patch helps only if it is installed, so people who stay on older builds remain exposed to a malicious app they have installed.
A pattern of warnings
This is not the first iOS alert from Binance this year. On March 20, it flagged a system-level flaw tied to DarkSword, an exploit chain disclosed by Google's Threat Intelligence Group that affects iOS 18.4 to 18.7. Binance said that exploit could trigger automatically without user interaction.
Binance later warned iPhone and iPad users to check whether they had installed FomoPeek, after researchers found malicious code in versions 1.1 and 1.2 that could expose wallet credentials. The app was marketed as a tool for tracking large crypto wallets. Binance said that malware targets the device itself, not a specific wallet app. In September, Apple also fixed CVE-2026-86950, a CoreGraphics flaw that may have been exploited against specifically targeted users. Nothing shows it is the same bug as worse_query.
How this differs from the Oct. 29 hack
The iOS warning is separate from the theft of about $6.34 billion that Binance disclosed after Oct. 29. In its incident report, the exchange said the attackers took months to prepare. They used fake job interviews and malicious software, and one engineer downloaded a malicious "assignment" onto a work computer. Binance has not linked worse_query to that attack, and no public report does either.
The two cases share a lesson about where wallets and exchanges get breached: on the devices of the people who use them. Binance says it has since replaced devices, rebuilt affected systems and scanned all employee devices.
Gunel Ismayilova
Disclaimer: All materials on this site are for informational purposes only. None of the material should be interpreted as investment advice. Cryptocurrency investments involve significant risk of loss. Please note that, despite the nature of much of the material created and hosted on this website, HODL FM operates as a media and informational platform, not a provider of financial advisory services. The opinions of authors and other contributors are their own and should not be taken as financial advice. If you require advice, HODL FM strongly recommends contacting a qualified industry professional.
