Bitcoin Magazine
Binance Warns iOS Flaw Could Expose Wallet Seed Phrases as Apple’s Latest iPhone Patch Stays Silent
Binance warned iPhone users Tuesday that a publicly released iOS flaw could let malicious apps read files stored by other apps, including the seed phrases and private keys that control crypto wallets.
“A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem,” the exchange wrote on X. “This is an iOS-level issue, not unique to Binance.”
Binance told users to delete any apps installed from untrusted sources, such as sideloaded or manually signed IPA files, and to update iOS and every app to the latest official versions. Anyone who suspects a breach should move funds to a new wallet created on a clean device and reset all active login sessions, the exchange said.
Neither Binance nor the researcher behind the flaw has reported any thefts tied to it.
What worse_query does
The bug is a sandbox escape. On iOS, each app is supposed to live in its own container that other apps cannot read. A researcher who posts as forcequitOS released worse_query on GitHub on Nov. 8, calling it “a zero-day sandbox escape for iOS 26 and 27, again.” It succeeds an earlier exploit, bad_query.
The project’s README says it works on iOS 26.0 through 26.7.2 and on iOS 27.2, a wider range than the versions Binance named. It lists paths it can reach, including other apps’ data containers and shared app group folders.
The researcher describes it as “a proof-of-concept for developers” that “isn’t useful by itself,” and stresses it is not a jailbreak. To use it, a developer has to build it into an app.
That has already happened in at least one case. A day after the release, developer Christoph Kolbicz published a file manager built on worse_query that lets users browse and edit app data on iOS 27 without jailbreaking, which he said was tested on iOS 27.0.1.
Blockchain security firm SlowMist called worse_query a container sandbox escape rather than a jailbreak. Its chief information security officer, who posts as 23pds, wrote that the flaw will not steal assets on its own. The risk comes when a user installs and runs an untrusted IPA that then reads other apps’ containers, and only if a wallet stores mnemonic phrases, keystores or WebView caches in plain text on the device.
Apple’s iOS updates don’t mention it
Apple shipped iOS 27.2.1 and iOS 26.7.3 on Nov. 9, a day after the proof of concept went public. Their security notes list fixes for AirPlay, Bluetooth pairing, brotli and other components, but neither names worse_query or describes a sandbox escape of this kind.
That leaves it unclear whether the latest iOS builds block the technique.
The exposure depends heavily on how each wallet app stores secrets. By SlowMist’s reading, wallets that do not write recovery phrases or keys to plain files on the device are not exposed in the same way, and hardware wallets keep private keys off the phone entirely. The attack also requires a user to install software from outside the App Store first.
The warning comes from an exchange still recovering from its own breach. Binance lost $6.34 billion in an Oct. 29 attack that began with a fake job interview. Security worries have also pushed some large holders to swap self-custodied bitcoin for IBIT shares, while hardware wallet maker Ledger said an organized crime group spent millions targeting its users.
For iPhone users holding bitcoin in a mobile wallet, Binance’s advice amounts to basic hygiene: stay on official iOS releases, skip sideloaded apps and move funds if a device may have been compromised.
This post Binance Warns iOS Flaw Could Expose Wallet Seed Phrases as Apple’s Latest iPhone Patch Stays Silent first appeared on Bitcoin Magazine and is written by Micah Zimmerman.
