Binance Warns iOS Flaw Could Expose Wallet Seed Phrases as Apple’s Latest iPhone Patch Stays Silent

Binance warned iPhone users Tuesday that a publicly released iOS flaw could let malicious apps read files stored by other apps, including the seed phrases and private keys that control crypto wallets.

“A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem,” the exchange wrote on X. “This is an iOS-level issue, not unique to Binance.”

Binance told users to delete any apps installed from untrusted sources, such as sideloaded or manually signed IPA files, and to update iOS and every app to the latest official versions. Anyone who suspects a breach should move funds to a new wallet created on a clean device and reset all active login sessions, the exchange said.

Neither Binance nor the researcher behind the flaw has reported any thefts tied to it.

The bug is a sandbox escape. On iOS, each app is supposed to live in its own container that other apps cannot read. A researcher who posts as forcequitOS released worse_query on GitHub on Nov. 8, calling it “a zero-day sandbox escape for iOS 26 and 27, again.” It succeeds an earlier exploit, bad_query.

The project’s README says it works on iOS 26.0 through 26.7.2 and on iOS 27.2, a wider range than the versions Binance named. It lists paths it can reach, including other apps’ data containers and shared app group folders.

The researcher describes it as “a proof-of-concept for developers” that “isn’t useful by itself,” and stresses it is not a jailbreak. To use it, a developer has to build it into an app.

That has already happened in at least one case. A day after the release, developer Christoph Kolbicz published a file manager built on worse_query that lets users browse and edit app data on iOS 27 without jailbreaking, which he said was tested on iOS 27.0.1.

Blockchain security firm SlowMist called worse_query a container sandbox escape rather than a jailbreak. Its chief information security officer, who posts as 23pds, wrote that the flaw will not steal assets on its own. The risk comes when a user installs and runs an untrusted IPA that then reads other apps’ containers, and only if a wallet stores mnemonic phrases, keystores or WebView caches in plain text on the device.

Apple shipped iOS 27.2.1 and iOS 26.7.3 on Nov. 9, a day after the proof of concept went public. Their security notes list fixes for AirPlay, Bluetooth pairing, brotli and other components, but neither names worse_query or describes a sandbox escape of this kind.