Binance Warns 3 iOS Versions Could Expose Crypto Wallet Keys

Binance Flags Three iOS Versions

Binance warned iPhone users on Tuesday, November 10 that a flaw in Apple's mobile operating system could expose the credentials controlling their cryptocurrency if a malicious app runs on the same device. In a security notice on X, the exchange listed iOS 26.7.1, 27.0.1 and 27.2 among the affected versions and said a malicious application can read local files that belong to other apps. Where a wallet or another program keeps seed phrases, private keys or login credentials in files the flaw can reach, that data is at risk. Binance described the problem as “an iOS-level issue, not unique to Binance” and said the exposure spans “the entire ecosystem,” covering cryptocurrency wallets and any app that stores sensitive customer data on the device. The three flagged builds span Apple's two most recent release branches, iOS 26 and iOS 27, so the warning covers devices already moved to the current system and those still on the older one. iOS 27.2 had been in circulation since October 26, meaning the newest affected version has been live for about two weeks. Apple shipped iOS 27.2.1 and 26.7.3 on Monday, but neither the company's advisories nor Binance's notice confirms that either update closes this specific hole. Pending clarity, the exchange set out three steps: remove any app installed from an untrusted source, update iOS and all installed apps to their latest official versions, and, where a compromise is suspected, create a new wallet on a clean device and transfer funds into it. Binance's advisory adds that active login sessions should be reset after any such move. The notice reported no confirmed theft tied to the flaw so far.

@binance · X post

Security notice on X.

View on X

Sandbox Escape Behind worse_query

The flaw has since acquired a name: worse_query. A public research repository documents it as a sandbox escape, meaning an application can move beyond the file-access permissions Apple's sandbox enforces and reach directories normally closed to other software. The published proof of concept covers several iOS 26 and iOS 27 releases, and its author states the code is a developer proof of concept, not a jailbreak. Nothing in the repository establishes that the technique has been used to steal cryptocurrency. Patch status is the open question. Apple's security release records show iOS 27.2 became available on October 26 and iOS 27.2.1 followed on November 9, with the newer release addressing several vulnerabilities affecting user information and device security. But Apple's published advisories do not mention worse_query by name, and no CVE identifier has been assigned to the reported sandbox escape, so the advisories do not establish whether the latest update closes the access method the researcher described. In a separate September disclosure, Apple patched CVE-2026-86950, a CoreGraphics vulnerability associated with possible targeted exploitation, though no evidence ties it to worse_query. An October advisory documented additional file-access fixes, including protections against unauthorized access to sensitive information. The warning also lands on a device ecosystem with a recent history of crypto-focused mobile attacks. Binance itself cautioned users in September about FomoPeek versions 1.1 and 1.2 after researchers found malicious code capable of reading beyond the app's normal permissions; security firm SlowMist's investigation flagged exploit methods designed to gain elevated access to Apple devices, with risks to locally stored recovery phrases and passwords. Separately, security firm CertiK warned on November 6 that an updated DarkSword exploit framework could target crypto applications on vulnerable iPhones, naming MetaMask, Trust Wallet, Phantom, Exodus and Coinbase among reportedly targeted apps. Those findings concern a different framework and do not show that worse_query has been deployed against crypto users. Binance had not responded to further comment requests at the time of writing.

Hardware Storage Limits Exposure

The practical severity turns on where key material actually lives. A hot wallet that holds keys inside an app's local files on an iPhone sits directly in the path of this flaw, since a sandbox escape that reaches those files reaches the keys. A hardware wallet signs transactions on a separate device and keeps the private key off the phone, so file access alone does not reveal it; the same holds for a cold wallet setup that never places key material on the device. A wallet address, by contrast, is public information and loses nothing if a file is read. What COINOTAG watches next is whether Apple assigns a CVE number and names the fix; until then, the confirmed record is Binance's advisory and a patch status no release note has yet resolved.