“A problem with iOS”: Binance warns of an iPhone flaw that threatens all crypto wallets

Binance warns iPhone owners. A flaw, called worse_query, has just been discovered in the iOS operating system. It allows a malicious application to read files from other applications, including crypto wallet recovery phrases. According to researchers, the breach has still not been fixed by Apple, putting iPhone investors at risk.

Binance is sounding the alarm. In a message published on According to the platform, updates iOS 26.7.1, iOS 27.0.1 and iOS 27.2 are affected.

A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.…

Binance emphasizes that the problem does not come from its iOS application. Yi He, co-founder of the crypto platform, highlights that “this is a problem at the iOS level”. Clearly, all crypto wallets installed on a vulnerable iPhone are potentially affected. Note that the iOS flaw has nothing to do with the Binance hack, whose loot is still being laundered on blockchains.

On iPhone, each application normally operates in a space isolated from the rest of the OS, called the “sandbox”. An application cannot therefore search through the files of another application, for obvious security reasons. The worse_query flaw allows you to bypass this protection. Discovered by two researchers, @0xjohnny and @forcequitOS, the flaw was demonstrated on GitHub. It is possible to exploit the flaw to obtain confidential data, or delete information from an app.

On paper, hackers could use the vulnerability to penetrate the crypto wallets of iPhone owners, by stealing the recovery phrase from an application. To achieve his goals, the attacker must develop a malicious iOS application, programmed to exploit the failure.

“An attacker should still be able to install malware on the targeted iPhone, for example by convincing its owner to install an application from an untrusted source,” explains Bitdefender in a report on the incident.

The risk therefore mainly concerns users who install applications outside the App Store. Furthermore, the flaw “does not automatically expose all crypto wallets”. The risk “depends on how each application stores and protects its sensitive information,” explains the antivirus publisher.

For Charles Guillemet, technical director of Ledger, this type of flaw “was previously very costly and reserved for attackers with significant resources”. Its cost is now tending “towards zero, and they are now exploited on a large scale”, probably because of the rise of artificial intelligence. “Just don’t store anything valuable on your mobile, especially not your crypto recovery phrases,” recommends the manager.

Unfortunately this kind of vulnerability used to be very expensive and reserved for high potential attackers. Their cost is trending towards zero and are now exploited at scale.

Simply don’t store any valuable in your mobile, especially not your crypto seeds…

A few days ago, Apple rolled out iOS 27.2.1, an update packed with fixes. However, Apple has not corrected the flaw pointed out by Binance. Neither iOS 27.2.1 nor the first beta of iOS 27.3 fixes the flaw. Good news, no theft of cryptocurrencies exploiting the vulnerability has been reported yet.

Apple connected glasses: a Chinese supplier puts us on the trail of several projects

Google urgently fixes an 8th Chrome flaw exploited by hackers, install the update quickly

Apple draws a line under its mutual help forum, an institution almost 28 years old

Windows: two BitLocker vulnerabilities allow protected files to be read

Best crypto platform: which exchange to choose in 2026?

Machine-translated from French