Binance warns of iOS sandbox escape with no fix confirmed in Apple’s updates

Binance warned iPhone users on Nov. 10, 2026 that an iOS vulnerability named worse_query lets malicious software read files kept by other applications, putting seed phrases, private keys and login credentials at risk across the iOS ecosystem. The exchange called worse_query an iOS-level issue affecting more than Binance.

A sandbox escape removes the wall that prevents one app from looking at another app’s private storage. The researcher’s demonstration works only when an app sets up an App Group container, a shared storage area. On an iPhone, the proof of code reaches every app data container, and on iOS 27 it also reaches certain system folders. SlowMist stresses that the flaw by itself steals nothing.

For a criminal app to read a wallet, it must be running on the phone, create an App Group directory, and find the wallet’s seed phrase or keystore stored unencrypted in its own folder. A seed phrase is 12 or 24 words that derive every key for a wallet, and anyone who knows it can rebuild the balance on any device and empty it. Nobody involved has stated whether worse_query reaches the iPhone keychain or ruled that out.

The researchers forcequit and 0xjohnny published worse_query on GitHub on Nov. 8, 2026, calling it a proof of concept aimed at developers that is not useful by itself. In an X reply, forcequit said the early release was not planned and that Apple was delaying its response: “Apple was stalling on responding to me and people started larping with it on here.”

Binance named iOS 26.7.1, 27.0.1 and 27.2 as affected versions on Nov. 10, 2026, citing WQ Files release notes. Documentation from the researcher dated Nov. 8, 2026 puts the affected range at iOS 26.0 through 26.7.2, plus iOS 27.2. Binance and the researcher disagree about the affected iOS releases. Neither list includes older devices running iOS 18.

Sideloading tools AltStore and SideStore create the App Group directory that the technique requires. Sideloading means installing apps outside the App Store. Whether an App Store app could also use the technique is unknown, and the risk only materializes if a malicious app installed outside the store is running on the phone.

Binance told users to delete apps from untrusted sources, among them sideloaded or manually signed apps, and to keep iOS and every app on the latest official release. Profiles used to sign apps outside the store appear in the device settings under General, VPN and Device Management. Users should delete unidentified profiles together with the apps tied to them. If users suspect a breach, they should move funds to a fresh wallet on a clean device and reset all active login sessions.

A clean device carries no apps from outside sources, runs current software and preferably uses a hardware wallet. A hardware wallet creates and stores private keys on its own chip and never releases them. The phone sends only the transaction that needs signing, and the user approves it by pressing a button on the device. On a device with a hardware wallet, a foreign app reading every iPhone folder turns up no key, only public addresses and balances.

Users should not keep a seed phrase in the Notes app, in a screenshot or in iCloud, and keep most funds on a hardware wallet, moving only the amount needed for the coming weeks onto the iPhone. Binance says users should move their balance to a new wallet created on a clean device and write the new seed phrase down offline. Users should send a small test transfer first and move the rest only after it arrives. Users must never reuse an old seed phrase, even for a new app, since an attacker could already know it.

For Ethereum and other EVM-based tokens, approvals stay tied to the old address, and users should revoke them if any balance remains there. Login data and session tokens kept by exchange apps allow the app to remain signed in. An attacker holding a session token can get into the account without the password. Withdrawals can demand a hardware key or an authenticator app, and that second device means the compromised iPhone alone is not enough.

A withdrawal allow list allows withdrawals only to pre-approved addresses, after a waiting period for new entries. Exchanges holding MiCA authorization must follow fixed EU rules on IT security and safeguarding client funds.

Binance and the researcher have reported no attacks or thefts involving worse_query, and no one has confirmed cryptocurrency theft through the flaw. A spokesperson said no known attacks have opened cryptocurrency wallets or stolen money using this flaw, and said the underlying file access risk might extend to every part of the iOS ecosystem. Binance named no specific wallet app as exposed. The risk extends beyond cryptocurrency wallets because attackers can also expose locally stored app data, including passwords, login credentials and personal files.

Developer Christoph Kolbicz created WQ Files, a file manager built on worse_query. WQ Files can read other apps’ data and change, delete or wipe it without a jailbreak or a kernel exploit, an attack on the operating system’s core. Users install it through sideloading tools like AltStore and SideStore.

Binance’s September 2026 warning covered FomoPeek, a cryptocurrency market-tracking app distributed via Apple’s official App Store. FomoPeek versions 1.1 and 1.2 contain malicious code able to steal private keys, seed phrases and other sensitive data. SlowMist and OKX’s security team found two hidden modules in those versions; one contained an iOS kernel exploitation framework built around eight attack methods for iOS 12.0 to 26.1. Version 1.0 was clean; the malicious code showed up in version 1.1 on Sept. 9, remained in version 1.2 on Sept. 12, and version 1.3 removed it on Sept. 17, 2026.

SlowMist flagged DarkSword on Oct. 24, 2026, a separate iOS exploit framework aimed at cryptocurrency users. CertiK said the DarkSword exploit framework reportedly targeted cryptocurrency apps through hacked websites and vulnerable iPhones. Researchers counted more than 1,500 linked phishing sites impersonating exchanges, wallets and other online services.

Binance’s security breach on Oct. 29, 2026 involved roughly $6.3 billion in stolen cryptocurrency and compromised internal infrastructure. No link exists between the two events.

Worse_query follows an earlier exploit called bad_query as its direct successor. Apple’s support notes say the company will not disclose, discuss or confirm security problems until it investigates them and a patch or release exists. The iOS 27.2.1 and iOS 26.7.3 updates addressed two iMessage flaws and several Bluetooth bugs.

Apple shipped iOS 27.2.1 and iOS 26.7.3 on Nov. 9, 2026. Those update notes do not mention worse_query or any sandbox vulnerability, and Apple has not publicly confirmed whether the November updates fix the flaw. Worse_query has no confirmed fix yet, and no CVE entry exists for the vulnerability. SlowMist chief information security officer 23pds tweeted that iOS 27.2.1 would stop the worse_query sandbox escape, but Apple has not independently confirmed that the update blocks the technique.