Binance iPhone vulnerability: is your crypto wallet exposed?

Every iPhone app is supposed to live in its own locked room. Apple calls this the sandbox: an app can see its own files, and nothing else. worse_query is what security people call a sandbox escape, a way for an app to slip out of that room and look around the rest of the house.

A security researcher who posts as forcequitOS put a proof of concept on GitHub on Nov. 8, crediting a second researcher known as 0xjohnny. The pair describe it as the follow-up to an older trick called bad_query. Soon after, a companion app named WQ Files appeared that can list, copy, change and erase other apps’ data on affected iPhones, and it does this without a jailbreak.

That last part is what worried crypto firms. Many wallet apps keep sensitive material on the device. If a wallet stores its recovery phrase in plain, unencrypted form, a malicious app that escapes the sandbox could read it, and whoever holds a recovery phrase holds the money. Blockchain security firm SlowMist flagged exactly that risk on the same Tuesday Binance posted its alert.

Binance listed three releases. The researchers’ own write-up casts a wider net. Here is how the two lists compare:

• Binance’s list: iOS 26.7.1, iOS 27.0.1 and iOS 27.2.
• The researchers’ list: iOS 26.0 through 26.7.2, plus iOS 27.2.
• WQ Files: confirmed working on the same three versions Binance named.

So if your iPhone runs any iOS 26 release before 26.7.3, or iOS 27.2, treat it as exposed until it is updated. The fact that the lists don’t match is itself a reason not to assume you’re fine because your exact version isn’t on Binance’s post.

One thing that limits the danger: worse_query is not a drive-by attack. Simply visiting a website or getting a message won’t trigger it. Someone has to get a malicious app onto your phone first, most likely through a sideloaded app from outside the App Store.

Apple shipped iOS 27.2.1 and iOS 26.7.3 on Monday, November 9, one day after the proof of concept went public. Apple also put out iOS 18.7.12 the same day. The iOS 27.2.1 security notes list nine fixes, covering AirPlay, Bluetooth, Messages, App Intents and a compression library called brotli.

One entry stands out. Under App Intents, Apple fixed CVE-2026-113963, which it describes as a bug through which an app could get at sensitive user data. It was reported by a researcher named László Várady. That sounds close to worse_query, but nothing in Apple’s notes mentions worse_query by name, and the researcher’s report points to App Intents rather than the shared App Group storage the worse_query write-up describes. It may be a different bug.

A SlowMist security lead who posts as 23pds has said iOS 27.2.1 blocks the technique. Apple itself has not confirmed that, and it did not answer questions from reporters about the flaw. Binance says it has passed its concerns to Apple directly.

Our read: install the update anyway. Even if it doesn’t close worse_query, iOS 27.2.1 fixes nine other real problems, including an iMessage bug that could let an outsider join a group chat and read its messages. The update is available for the iPhone 11 and later.

For most people who only install apps from the App Store, the practical risk today looks low. The attack needs a malicious app on the phone, and no theft has been confirmed. A Binance spokesperson said the company had found no case of attackers using worse_query to reach wallets or take funds, while warning that the file-access problem could reach well beyond Binance’s own app.

The people who should act fastest are those who:

• have installed apps from outside the App Store, such as manually signed IPA files or sideloaded tools;
• keep large balances in a hot wallet app, the kind that holds keys on the phone itself;
• have ever stored a recovery phrase on the phone as a note, a photo or a screenshot.

That last group deserves a moment. The sources are clear that the danger becomes real when a rogue app finds wallet secrets saved in a readable form. A recovery phrase saved in your photo roll or notes app is exactly that kind of file. Writing it on paper and deleting the digital copy takes it off the table for this kind of attack.

Binance’s advice boils down to four steps. Here they are in the order we’d do them:

1. Update iOS. Open Settings, tap General, then Software Update, and install iOS 27.2.1 (or iOS 26.7.3 if you are staying on iOS 26). To check what you’re running now, go to Settings, General, About.
2. Update every app. Open the App Store, tap your profile picture and pull down to refresh, then choose Update All.
3. Delete untrusted apps. Remove anything you sideloaded, anything from a developer you don’t recognize, and any app you no longer use. Fewer apps means fewer places for a rogue one to hide.
4. If you think you’ve been hit, start fresh. Set up a brand-new wallet on a phone you trust, move your coins into it, and sign out of every active login session on your exchange accounts.

Step four matters because a leaked recovery phrase can’t be changed. Once someone else has it, the only safe move is to send the funds to a new wallet with a new phrase they’ve never seen.

This warning lands at an awkward time for the exchange. On Oct. 29, Binance suffered a breach of its own systems that saw about $6.3 billion in crypto stolen. That incident involved Binance’s internal infrastructure, not iPhones, and nothing links the two events. Binance has said it will cover customer losses from the breach.

It also isn’t the same thing as Darksword, a separate iOS attack kit that SlowMist warned about on Oct. 24. Darksword works differently: it attacks through booby-trapped web pages, so victims don’t need to install anything. Researchers tied it to more than 1,500 phishing sites posing as exchanges and wallet services.