Binance Warns of iOS Flaw That Could Expose Wallet Keys

Binance on November 10 warned iPhone users about an iOS flaw that could let a malicious app read local files belonging to other apps, including seed phrases, private keys and login credentials. The exchange listed iOS 26.7.1, 27.0.1 and 27.2 as affected, and stressed that this is an iOS-level issue, not unique to Binance.

Details

The flaw is known as worse_query. Crypto.news reports that a researcher using the handle forcequitOS published proof-of-concept code on GitHub on November 8. It escapes the iOS app sandbox so one app can read another's files. The author describes it as a developer proof of concept and says it is not a jailbreak. According to CoinCentral, the demo requires an App Group entitlement, which ordinary apps typically lack.

Apple released iOS 27.2.1 and 26.7.3 on November 9, but Cointelegraph notes it is unclear whether either update fixes the issue: Apple's release notes do not mention worse_query and no CVE has been confirmed. The sources report no evidence of attacks on real users.

Binance advises deleting apps installed from untrusted sources, updating iOS and all apps to the latest official versions, and moving funds to new wallets created on a clean device if a breach is suspected.

What it means for the market

The news has no direct market impact, but it is a reminder of a core self-custody risk: seed phrases and keys are exposed when other code can read them on the same device. Until it is clear whether the hole is closed, installing the latest iOS updates and avoiding sideloaded apps is the sensible minimum.

Holders of larger balances may prefer hardware wallets, where keys never leave the device. For the day's market picture, see the daily brief. This is not investment advice.