Binance has warned iPhone users about an iOS vulnerability that could allow malicious apps to access files belonging to other applications, potentially exposing cryptocurrency recovery phrases, private keys and login credentials.
The exchange issued the warning on November 10, identifying iOS versions 26.7.1, 27.0.1 and 27.2 as affected. It stressed that the issue lies within Apple’s operating system and is not limited to the Binance app or any single cryptocurrency wallet.
The vulnerability, known as worse_query, could allow an app to bypass normal security restrictions and read files that should be accessible only to other applications. This could put sensitive information at risk if it is stored on the device in a form that the malicious app can access and recover.
Binance has not identified confirmed cases of cryptocurrency theft linked to the vulnerability.
How the iOS vulnerability threatens crypto wallets
Apple uses a security mechanism called an application sandbox to isolate apps from one another. Under normal conditions, this prevents an app from freely accessing another app’s private files.
The worse_query vulnerability reportedly bypasses these restrictions, potentially allowing a malicious application to browse or extract data from other apps without requiring a device jailbreak.
For cryptocurrency users, the risk depends on what information a wallet stores locally and how it protects that information. If a malicious app gains access to files containing exposed recovery phrases or private keys, an attacker could potentially use those credentials to take control of a wallet and move its funds.
A recovery phrase is particularly sensitive because it can allow someone to restore a self-custody wallet on another device. Unlike a password for an exchange account, a wallet recovery phrase may give its holder direct control over the assets associated with that wallet.
However, the vulnerability does not automatically expose every iPhone user’s wallet. The risk depends on the device’s software version, whether a malicious app is installed and running, and how the affected applications store sensitive information.
Apple updates have not been confirmed as a fix
The warning raises questions about whether Apple has fully addressed the vulnerability.
Apple released security updates for several operating system versions on November 9, including iOS 27.2.1 and 26.7.3. However, the published security information does not clearly confirm whether those updates resolve the specific issue described by Binance.
Users should therefore check Apple’s official security advisories for the latest information rather than assume that installing an update has definitively resolved this particular vulnerability.
Binance advises users to secure their wallets
Binance has recommended several precautions for iPhone users:
- Remove untrusted apps: Delete unnecessary applications, particularly apps installed through unofficial sources or manually signed installation files.
- Update your device: Install the latest official iOS release available for your device, along with updates for installed applications.
- Move funds if compromise is suspected: Create a new wallet on a clean, trusted device and transfer assets to it if you believe your recovery phrase or private keys may have been exposed.
- Secure account access: Change potentially compromised passwords and reset active login sessions from a trusted device.
Users should never share their recovery phrases or private keys with anyone claiming to provide technical support. They should also avoid entering wallet credentials into unfamiliar apps or websites.
For self-custody wallet holders, the warning is a reminder that securing cryptocurrency involves more than protecting a wallet application. The security of the device holding sensitive information is also critical.
Although no confirmed cryptocurrency theft has been linked to worse_query, users running affected software should take the warning seriously and avoid installing applications from sources they do not trust.
Read also: Anthropic adds $10B in new compute commitments to Microsoft, Google