Binance iOS flaw: worse_query exposes 3 iOS versions, Apple silent

Editor’s take (Keshav Aggarwal): My trust in Apple is unchanged; Binance's recent hack has made it security-serious, so its warning is meaningful. I'd tell users to wait for Apple, avoid third-party iOS apps, and watch for Apple's clear answer.

Binance warned iPhone users on Nov. 10 that a publicly released iOS sandbox escape called worse_query could let malicious apps read files stored by other apps, putting seed phrases, private keys and login credentials at risk. The Binance iOS flaw covers iOS 26.7.1, 27.0.1 and 27.2, the exchange said, describing it as “an iOS-level issue, not unique to Binance.”

Neither Binance nor the researcher behind the exploit has reported any theft tied to it. “At present, we have not identified any confirmed cases in which attackers used worse_query to access cryptocurrency wallets or steal funds,” a Binance spokesperson told crypto.news.

“A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.” — Binance, on X

The Binance iOS flaw, in plain terms

iOS runs every app inside a sandbox: a private container that other apps are not supposed to read. A sandbox escape is code that steps outside that container and reaches data it should never see — in this case, other apps’ data containers and shared app group folders, according to the repository.

The researcher who posts as forcequitOS published worse_query on GitHub on Nov. 8, calling it “a zero-day sandbox escape for iOS 26 and 27, again.” Decrypt reports it is the “direct successor” to an earlier exploit named bad_query. The README lists a wider range than Binance named — iOS 26.0 through 26.7.2 and iOS 27.2 — and the author describes it as “a proof-of-concept for developers” that “isn’t useful by itself,” stressing it is not a jailbreak. A developer has to build it into an app.

That has already happened once. A day after the release, developer Christoph Kolbicz published a file manager built on worse_query that lets users browse and edit app data on iOS 27 without jailbreaking, which he said was tested on iOS 27.0.1, according to Bitcoin Magazine.

Binance iOS flaw: which wallets are actually exposed

Exposure depends on how each wallet stores secrets, not on the bug alone. SlowMist, which called worse_query a container sandbox escape rather than a jailbreak, said the flaw will not steal assets on its own. The risk arrives when a user installs and runs an untrusted IPA that then reads other apps’ containers — and only if a wallet writes mnemonic phrases, keystores or WebView caches to the device in plain text.

Binance’s spokesperson framed it the same way: “Seed phrases, private keys and login credentials could be exposed if stored in those files in plaintext or otherwise recoverable form.” By SlowMist’s reading, wallets that do not write recovery phrases or keys to plain files on the device are not exposed in the same way, and hardware wallets keep private keys off the phone entirely.

That distinction matters for self-custody. A phone wallet that holds an encrypted keystore in the sandbox and demands a passphrase for every signature gives an attacker a file they still have to break. A wallet that leaves a recovery phrase in a plain file hands over the asset outright.

Why removing untrusted apps is the only real mitigation

Binance’s advice is narrow and, for most users, complete: delete any app installed from an untrusted source, such as sideloaded or manually signed IPA files; update iOS and every app to the latest official versions; and if a device may already be compromised, move funds to a new wallet created on a clean device and reset all active login sessions.

There is no wallet-side patch for this. Because the escape sits in the isolation layer of iOS itself, no app update can close it — only Apple can — so the practical defense is to remove the delivery mechanism, which is the untrusted app. App Store review is the barrier doing the work here: the attack requires installing software from outside Apple’s store first, which is why Binance’s instruction is an instruction about sideloading rather than about wallet software.

How to check whether your iPhone is patched

Apple shipped iOS 27.2.1 and iOS 26.7.3 on Nov. 9, a day after the proof of concept went public. The security notes for those builds list fixes for AirPlay, Bluetooth pairing, brotli and other components; Decrypt counts nine vulnerabilities in 27.2.1, including an App Intents authorization issue through which “an app may be able to access sensitive user data.” Neither advisory names worse_query or describes a sandbox escape of this kind.

SlowMist chief information security officer 23pds urged users to update to iOS 27.2.1, saying it blocks the worse_query escape along with other threats. Binance is more cautious. “We do not currently have verified information confirming a security patch or a CVE number for this specific vulnerability,” its spokesperson said, adding that the researcher’s public statements indicated the issue had been reported to Apple.

In practice, users on 27.2.1 or 26.7.3 are on the newest public builds and should confirm that in Settings; anyone on an older build named by Binance or listed in the repository should update before opening another wallet app.

Awkward timing for the industry

The warning lands while Binance is still recovering from its own breach: $6.34 billion lost in an Oct. 29 attack that began with a fake job interview, according to Bitcoin Magazine. Hardware wallet maker Ledger is dealing with an organized crime group that spent millions targeting its users, according to the same report.

The recent record is crowded. In September, Binance warned about FomoPeek versions 1.1 and 1.2 after SlowMist found exploit code capable of reaching data outside an app’s normal permissions. On Nov. 6, CertiK warned that an updated DarkSword framework could target crypto apps on vulnerable iPhones. Earlier in the year, Google flagged iOS malware aimed at crypto apps on unpatched devices.

Market backdrop: risk-off tape, security headline

The alert arrived into a defensive market. Total crypto market cap stood at $2.54 trillion on Nov. 10, down 2.79% in 24 hours, with 24-hour volume of $97.1 billion and bitcoin dominance at 57.7%, according to CoinPaprika data.

Bitcoin traded at $72,937, down 2.35% on the day and 6.01% on the week, and sits 42.2% below its all-time high of $126,173. Ether was at $2,021.60, down 4.82% in 24 hours and 11.95% over seven days. The Crypto Fear & Greed Index read 32 — “Fear” — up marginally from 29 a day earlier, per Alternative.me.

Security headlines do not move a tape this size on their own, and nothing in the data ties the decline to worse_query. But the episode adds to a pattern that has already pushed some large holders to swap self-custodied bitcoin for IBIT shares, as Bitcoin Magazine reported — a shift in custody preference that a mobile sandbox escape reinforces rather than reverses.

What to watch next

An Apple CVE assignment is the trigger for the next leg of this story. A CVE number would confirm an acknowledged vulnerability, give wallet vendors something concrete to test against, and settle whether 27.2.1 and 26.7.3 actually close the technique. Cointelegraph contacted Apple about the flaw and had not received a response at publication.

Beyond the CVE, watch for revised Apple security notes, for wallet developers publishing how they store recovery material on iOS, and for any confirmed report of exploitation. Until then, the risk is conditional: it requires a sideloaded app and a wallet that leaves secrets readable on disk.

Frequently asked questions

What is the worse_query iOS vulnerability?

It is a sandbox escape for iOS published on GitHub by a researcher using the handle forcequitOS on Nov. 8, 2026. It allows an app built with the code to read files belonging to other apps, including app data containers and shared app group folders, on a range of iOS 26 and iOS 27 builds.

Does worse_query steal seed phrases by itself?

No. SlowMist describes it as a container sandbox escape, not a jailbreak, and says it will not steal assets on its own. A user must first install and run an untrusted app built with the exploit, and a wallet must store mnemonic phrases or keys on the device in plaintext or recoverable form.

Has Apple fixed the flaw?

Apple shipped iOS 27.2.1 and iOS 26.7.3 on Nov. 9, but the security notes for those builds do not name worse_query. SlowMist's CISO says 27.2.1 blocks the escape, while Binance says it has no verified information confirming a patch or a CVE number. Apple has not responded publicly.

Sources: Bitcoin Magazine, Decrypt, Cointelegraph, crypto.news