Binance warns of an iOS flaw it says could expose wallet keys; Apple's update notes are silent on it

Binance warned iPhone users on November 10 that a flaw in Apple's iOS, which it called "worse_query," could let a malicious app read other apps' local files, and said that could expose seed phrases, private keys and login credentials. "This is an iOS-level issue, not unique to Binance," the exchange said in a post on X at 09:56 UTC.

What Binance said

On iPhones, Apple confines each third-party app to its own "sandbox," which is meant to stop it from reading or changing other apps' data, according to Apple's platform security guide. Binance said worse_query lets a malicious app on the same phone read local files kept by other apps; the code's author describes it as a sandbox escape.

The exchange gave three steps:

• Remove any app that did not come from an official source, including sideloaded apps and manually signed app packages (IPAs).
• Install the latest official versions of iOS and of every app.
• If you think the phone has been compromised, create a new wallet on a device you know is clean, move your funds to it, and log out of all active sessions.

Where the flaw comes from

The GitHub user forcequitOS published worse_query on November 8. The repository describes it as a sandbox escape for iOS 26.0 through 26.7.2 and iOS 27.2, and as a proof of concept for developers that "isn't useful by itself." It lists the folders the code can reach, including the one where iPhone apps keep their data, and calls it the "direct successor" to an earlier sandbox escape by the same author, bad_query.

The version lists differ: Binance names iOS 26.7.1, 27.0.1 and 27.2, while the repository gives a range of iOS 26.0 through 26.7.2, plus 27.2, and does not mention 27.0.1.

What Apple's update says

Apple released iOS 27.2.1 on November 9, according to its security notes, which list fixes for nine vulnerabilities. One, in App Intents, is described as an authorization issue through which "an app may be able to access sensitive user data"; Apple credits that report to László Várady and does not link it to worse_query. The same day, Apple released iOS 26.7.3 for iPhones that stay on iOS 26; its notes list eight fixes. Neither set of notes mentions worse_query or its author, and neither says whether the update closes the hole Binance warned about.

23pds, a partner and the chief information security officer of blockchain security firm SlowMist, wrote on X that upgrading to iOS 27.2.1 would also stop the worse_query sandbox escape; Decrypt reported the same. Apple has not said so in its notes.

What it could mean for traders

The warning concerns phones, not exchange systems: the risk Binance describes is to keys and logins stored on a user's device, and the exchange said the issue is not unique to its own app. That sets it apart from a breach of an exchange's own systems, such as the October Binance hack (what the Binance hack showed about exchange risk). An attack using this flaw would first need a malicious app on the target's phone and would go after individual users' keys, much like the hijacked DeFi websites at the end of October, which targeted visitors' wallets rather than the projects' smart contracts. The practical steps are the ones Binance listed: install apps only from official sources and keep iOS and apps up to date.