Binance warned iPhone users on Tuesday, November 10, 2026, that a flaw in Apple’s iOS could let a malicious app read files belonging to other apps. Those files could contain wallet recovery phrases, private keys or login credentials. The flaw affects iOS, while each wallet app’s storage and encryption determine whether its users’ sensitive data is exposed.
Binance identified iOS 26.7.1, 27.0.1 and 27.2 among the affected versions. An iPhone app normally runs inside a sandbox that limits its access to other apps’ files. The flaw, called worse_query, lets an app reach directories that the sandbox normally protects, including the area where apps store their data.
The researcher’s worse_query repository contains code for developers to demonstrate the flaw. The researcher says using the published code requires an App Group container and describes its limits:
This is a proof-of-concept for developers and isn’t useful by itself.
forcequitOS, security researcher
Binance said a wallet’s exposure depends on how its app stores and encrypts sensitive data and controls access to it. A recovery phrase stored unencrypted on the device presents a different risk from encrypted key material. Access to an app’s files does not, by itself, make every wallet’s recovery phrase readable.
Apple released iOS 27.2.1 and 26.7.3 on Monday. Its security notes for iOS 27.2.1 describe a fix for an issue that could let an app access sensitive user data. The notes do not name worse_query. Binance reported no confirmed cases of wallet access or stolen funds through the flaw, and Apple has not confirmed whether the updates fix it.
Binance advised iPhone users to take these steps:
- Untrusted apps: Delete apps installed from unknown sources, including sideloaded or manually signed app files.
- iOS and apps: Install updates through official channels.
- Old wallet: If you suspect exposure, create a new wallet on a trusted device, transfer funds from the old wallet, and reset affected login sessions.
