Binance Raises Alarm Over Dangerous iOS Vulnerability Affecting iPhone Users

Binance has cautioned iPhone users about a potentially dangerous iOS security weakness that could expose cryptocurrency wallets, private keys, and account credentials. The vulnerability, known as worse_query, reportedly allows malicious applications to bypass Apple’s security restrictions and access files stored by other apps. Binance has identified multiple affected iOS releases and encouraged users to immediately delete applications from untrusted sources.

The reported threat is not restricted to crypto-related software. Applications containing locally stored passwords, authentication information, and personal documents could also be vulnerable. This raises concerns for iPhone owners who use their devices to access banking services, manage investments, and conduct cryptocurrency transactions.

The underlying issue involves Apple’s application sandbox, a security feature that prevents applications from accessing one another’s private data. Each app normally operates within its own protected environment, limiting unauthorized access to confidential files.

However, the worse_query exploit reportedly circumvents this isolation mechanism. If successfully exploited, a malicious application could potentially access directories containing sensitive information from other applications installed on the device.

The public GitHub repository documenting the vulnerability identifies it as an iOS sandbox escape affecting iOS 26 and iOS 27. The listed software versions include iOS 26.0 through 26.7.2, as well as iOS 27.2.

Binance warns that information at risk could include wallet seed phrases, private keys, and login credentials. Exposure of these details could allow attackers to compromise cryptocurrency accounts and potentially steal users’ funds.

The potential impact depends largely on how individual applications handle sensitive information. Wallets that store recovery phrases or authentication details in locally accessible files may face additional security risks.

SlowMist’s security chief has also raised concerns about the vulnerability, noting its potential to undermine the protections users expect from Apple’s application isolation system.

Binance Highlights Uncertainty Around Apple’s iOS Security Patches

Apple’s latest software updates have raised additional questions about whether the vulnerability has been resolved. The company’s security release records show that iOS 27.2 and iOS 26.7.2 were released on October 26, 2026.

Despite these releases, Apple’s official security documentation does not specifically identify the worse_query vulnerability. There is therefore no clear public confirmation that the updates completely eliminate the reported security weakness.

A separate GitHub project demonstrating the exploit stated on November 8 that Apple’s available software releases had not yet addressed the issue. This creates uncertainty for users who assume that installing the newest iOS version automatically protects their devices against the specific exploit.

Binance advises users to install the latest official iOS updates and regularly update their applications. It also recommends removing software downloaded from unknown sources, including manually signed IPA files.

For cryptocurrency holders, the potential consequences could extend beyond an infected application. If sensitive wallet credentials have already been accessed, deleting suspicious software may not be enough. Users should take additional measures to protect potentially exposed recovery phrases, private keys, and accounts.

Previous iPhone Attacks Increase Concerns Over Crypto Wallet Security

The latest warning follows other security incidents involving malicious applications and attempts to obtain cryptocurrency credentials from Apple devices.

In September, Binance alerted users to FomoPeek, a third-party application whose versions 1.1 and 1.2 reportedly included malicious code. Researchers found that the application could exploit iOS vulnerabilities to obtain elevated privileges on affected devices.

The potentially compromised information included wallet recovery phrases, private keys, account login details, and other sensitive files stored locally.

More recently, CertiK highlighted the DarkSword exploit framework, which reportedly targeted cryptocurrency applications through compromised websites and vulnerable iPhones.

Although the attacks rely on different techniques, they demonstrate the increasing security challenges facing cryptocurrency investors who use smartphones to manage their digital assets.

The worse_query warning ultimately highlights a critical aspect of self-custody. Keeping cryptocurrency secure requires protecting not only the wallet itself but also every location where recovery phrases, private keys, and other confidential information may be stored.