Binance Warns of Potential Leak of iPhone Users' Cryptocurrency Seed Phrases Due to iOS Vulnerability

Mechanism and Impact of Vulnerability worse_query

Major cryptocurrency exchange Binance has issued a warning to iPhone users regarding a vulnerability called worse_query present in Apple's iOS.

A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance. Immediate Action Required: -- Delete any apps installed from untrusted sources (such as sideloaded or manually signed IPAs). -- Update iOS and all apps to the latest official versions. -- If you suspect a breach, transfer funds to a new wallet created on a clean device and reset all active login sessions. Never install unauthorized packages, and keep your software up to date.

--- Binance (@binance) November 10, 2026

The vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This issue is not unique to Binance but stems from a system-level problem in iOS, where sensitive data such as cryptocurrency wallet seed phrases, private keys, and login information may be exposed through malicious apps. Normally, each application runs in an isolated environment called a sandbox, preventing access to private files of other apps.

However, the worse_query, released by a researcher known as forcequitOS on GitHub, is a sandbox escape technique that bypasses this restriction. According to public information, this vulnerability targets iOS versions 26.0 to 26.7.2 and 27.2, with Binance specifically pointing out its impact on iOS 26.7.1, 27.0.1, and 27.2.

Researchers and blockchain security firm SlowMist explain that this proof of concept (PoC) does not directly lead to asset theft on its own. The risk materializes only when users install apps from untrusted sources, and those malicious apps access the containers of other apps, especially if the wallet side stores private keys or recovery phrases in plaintext on the device.

Apple's Response and Update Status

Immediately after this proof of concept was released, Apple released iOS 27.2.1 and iOS 26.7.3. This security update includes fixes for authorization issues related to access to sensitive data; however, there has been no official mention of "worse_query" or its discoverer in the release notes or security information. Therefore, it remains unclear whether this specific technique is completely blocked in the latest builds.

In response, experts, including 23pds, the CISO of SlowMist, strongly recommend users promptly apply OS updates. As of now, there have been no confirmed cases of cryptocurrency theft resulting from this vulnerability.

Security Measures for iPhone Users and Cryptocurrency Holders

In light of this risk, Binance and various security firms are urging users to take the following measures:

Eliminate Untrusted Apps:
Quickly delete apps obtained from unofficial sources (such as sideloaded apps or manually signed IPA files). Update to Latest Versions:
Always keep iOS and all applications updated to the latest official versions. Manage Private Keys and Move Assets:
If there are suspicions of unauthorized access or concerns about breaches, create a new wallet on a verified safe device to transfer funds and reset all currently active login sessions. Response from Wallet Developers:
Wallet developers are also required to ensure that sensitive information and recovery phrases are not stored in plaintext on the device.

It is crucial for users handling cryptocurrency to utilize apps through official channels and maintain proper device management to prevent security risks proactively.