Binance Warns iPhone Users: Worse_Query iOS Flaw Could Expose Crypto Wallet Keys

Binance has warned iPhone users about a serious iOS flaw that could expose crypto wallet keys. The worse_query iOS flaw, named in a Binance security warning posted on November 10, 2026, is a sandbox escape that could let a malicious app read files belonging to other apps on the same iPhone — including wallet seed phrases, private keys and login credentials stored locally. Binance stressed the problem sits in Apple's operating system, not in its own app, and it could affect any app that keeps sensitive information on the device.

What Is the Worse_Query iOS Flaw?

The flaw breaks the sandbox, the iOS security boundary that is supposed to stop one app from reaching another app's private files. According to the public proof of concept published on GitHub by a researcher who goes by forcequit, worse_query lets an app cross that boundary and read other apps' data containers — and on iOS 27, some system folders too. The researcher describes the code as a developer proof of concept, not a jailbreak, and a file-manager app called WQ Files has already been built on it to browse, export, edit and delete other apps' data without a jailbreak.

That matters because crypto wallets often store their most sensitive data on the phone itself. Binance said the flaw could expose recovery phrases, private keys and login credentials if apps store them in files a malicious app can reach. SlowMist security chief 23pds separately warned that untrusted IPA packages — apps installed from outside the App Store — could use the access to expose wallet recovery phrases, keystores or browser cache data stored without encryption. The flaw does not automatically drain a wallet: an attacker first has to get a malicious app onto the phone.

• Binance warned iPhone users about worse_query on November 10, 2026.
• Affected versions named by Binance: iOS 26.7.1, 27.0.1 and 27.2.
• The public proof of concept covers iOS 26.0 through 26.7.2 and iOS 27 through 27.2.
• A malicious app could read other apps' files, including wallet seed phrases and private keys.
• No confirmed thefts have been attributed to worse_query, and no CVE number exists yet.
• Apple has not confirmed worse_query by name, and its November 9 updates do not list a fix for it.

Which iPhones Are Affected by Worse_Query?

Binance named three versions in its warning — iOS 26.7.1, 27.0.1 and 27.2 — the versions listed as tested in the WQ Files release notes. The research repository itself describes a wider range: iOS 26.0 through 26.7.2, and iOS 27 through 27.2. Apple released iOS 27.2.1 and iOS 26.7.3 on November 9, the day before Binance's warning, but the security notes for those releases do not mention worse_query or any sandbox issue, and neither Binance nor Apple has confirmed whether the newest updates close the flaw. Binance told crypto.news it has 'no verified information confirming a security patch or a CVE number for this specific vulnerability.'

Has Anyone Lost Crypto to Worse_Query?

Not that anyone has confirmed. Binance told crypto.news it has 'not identified any confirmed cases in which attackers used worse_query to access cryptocurrency wallets or steal funds,' and neither the exchange nor the researcher reported any attacks or thefts. No wallet app has been named as exposed, and it is not yet known whether an app distributed through the App Store could use the technique at all — the realistic route in is a sideloaded or manually signed app from an untrusted source. The warning was amplified by Binance co-founder Yi He and by Ledger chief technology officer Charles Guillemet, which is why it spread so fast across crypto social media.

What iPhone Users Should Do Now

1. Update your iPhone to the latest official iOS version, and update all your apps.
2. Delete any apps installed from untrusted sources, including sideloaded or manually signed apps you do not recognise.
3. Do not store seed phrases or private keys in plain files, notes or screenshots on your phone.
4. If you suspect a compromise, move your funds to a new wallet created on a clean device.
5. Reset all active login sessions for your exchange and wallet accounts.

Worse_Query iOS Flaw: Frequently Asked Questions

Worse_query is a warning, not yet a confirmed attack — but it is a serious one, because it targets the exact data crypto owners can least afford to lose. Until Apple confirms a fix, the safest move for iPhone users is the simplest: update, delete anything untrusted, and keep seed phrases off the phone entirely.