Binance warns of iOS worse_query flaw that could expose crypto wallet secrets

Binance issued a security advisory on November 10, 2026, warning about an iOS vulnerability named worse_query that could let malicious third-party apps read private local files stored by other applications, potentially exposing cryptocurrency seed phrases, private keys, and login credentials, and the exchange said worse_query exists at the iOS level and is not limited to the Binance app.

The advisory named iOS versions 26.7.1, 27.0.1, and 27.2 as affected. Binance said the flaw “allows malicious apps to read local files from other apps.” Crypto Briefing characterized the advisory as flagging a critical iOS vulnerability that could expose private keys, seed phrases, and login credentials, noting “covering both iPhones and iPads.”

Security researcher forcequitOS published a worse_query proof of concept on November 8, 2026, and credited researcher 0xjohnny with the discovery. forcequitOS described the project as a developer proof of concept that is not useful by itself and is not a jailbreak, calling it “a zero-day sandbox escape for iOS 26 and 27, again.” The researcher said it “isn’t useful by itself.” The proof of concept targeted iOS 26 and 27.

Exploiting worse_query requires an App Group entitlement or container, and an attacker must install the malicious tool on an iPhone, potentially by sideloading from untrusted sources outside the App Store. A separate tool called WQ Files uses worse_query to browse, export, edit, and delete other apps’ data without a jailbreak. WQ Files has been confirmed to work on iOS 26.7.1, 27.0.1, and 27.2, while the proof-of-concept documentation says it works on iOS 26.0 through 26.7.2 and on iOS 27.2. CoinCentral said the documentation “lists accessible application, extension, and shared-container directories across iOS 26 and 27.”

Files at risk could contain cryptocurrency seed phrases, private keys, and login credentials. Reading a wallet’s files does not automatically reveal usable private keys if the data uses encryption or separate protection, and many users keep exchange apps, self-custody wallets, and authenticator apps on the same device, concentrating risk if one app reads another’s files. A seed phrase has no server-side protections, so customer support cannot reverse a leaked phrase.

Binance issued an earlier advisory in September 2026 about a different malicious app that exploited iOS vulnerabilities. Google warned earlier in 2026 about iOS malware targeting crypto apps on unpatched devices. Binance lost $6.34 billion in an October 29, 2026, attack that began with a fake job interview, and the exchange has warned about iOS threats.

Apple released iOS 27.2.1 and iOS 26.7.3 on November 9, 2026, and also released iOS 18.7.12 as part of the same security updates. The November 9 updates fix nine flaws including CVE-2026-113963, which could let an app access sensitive user data. László Várady reported CVE-2026-113963, and it involves access through App Intents rather than App Group containers. The releases followed forcequitOS’s November 8, 2026, proof of concept.

It is unclear whether CVE-2026-113963 is the same issue Binance described. Apple’s security notes for iOS 27.2.1 and 26.7.3 do not explicitly confirm a fix for worse_query. SlowMist chief information security officer 23pds said updating to iOS 27.2.1 would block the worse_query sandbox escape.

Binance stated that it had confirmed no cryptocurrency losses as of November 10, 2026. Binance advised users to delete unnecessary and untrusted apps, including sideloaded or manually signed IPA files (iOS app packages), and to update iOS and all apps through official channels only, because the attack requires the user to install software from outside the App Store first. If someone suspects a compromise, Binance advised creating a new wallet on a clean device and moving funds there, then resetting every active login session. Hardware wallets keep private keys off the phone entirely.

Binance said “Never install unauthorized packages, and keep your software up to date.” Binance co-founder Yi He and Charles Guillemet endorsed the advisory.