Science & Tech · Cybersecurity · 9 hrs ago
Binance warns iOS flaw could expose wallet secrets
Binance warned iPhone users about a flaw affecting iOS versions 26.7.1, 27.0.1 and 27.2.
The issue, called worse_query, could let malicious apps read files stored by other apps, including crypto wallet recovery phrases, private keys and login details.
A public proof-of-concept has been used to make an app that can browse other apps’ data, but it must be installed on the phone, including through sideloading.
No attacks or crypto losses have been confirmed by Binance or the researcher cited in the coverage.
Binance recommends updating iOS and apps, and deleting apps from untrusted sources.
If a breach is suspected, move funds to a new wallet made on a clean device and reset active login sessions.
Apple released security updates, but it has not clearly confirmed that they fix the specific flaw Binance warned about.
Binance warned that a flaw in several iOS versions could let malicious apps read files held by other apps.
The potentially exposed information includes cryptocurrency recovery phrases, private keys and login credentials.
The exchange said the issue affects iOS broadly, not only the Binance app.
It urged users to remove untrusted apps and install the latest official updates for iOS and their apps.
Binance reported no confirmed cryptocurrency losses; sources say no attacks or data theft had been reported.
Apple released security updates, but it is unclear whether they fix the flaw Binance described.
- Who
- Binance warned iOS users about the vulnerability.
- What
- A flaw could let malicious apps read local files from other apps, potentially exposing wallet secrets and login details.
- When
- Binance issued its warning on November 10, 2026.
- Where
- The issue affects iOS devices running versions 26.7.1, 27.0.1 and 27.2.
- Why
- The vulnerability could allow apps to cross security boundaries and access other apps’ files.
This story does not have two clearly opposing sides.
Researcher forcequitOS posted that they were willing to give up any potential Apple bug bounty.
BleepingComputer says a proof-of-concept exploit using worse_query was published.
Apple released security updates for iOS, but sources do not establish whether they fix the issue Binance warned about.
Binance warned users that the vulnerability could expose files stored by other apps.
- Affected iOS versions
- 26.7.1, 27.0.1 and 27.2
- Vulnerability name
- worse_query
- Potentially exposed data
- Seed phrases, private keys and login credentials
- Binance warning date
- November 10, 2026
- Example app using the technique
- WQ Files
4 sources
What people are saying
A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem
This is an iOS-level issue, not unique to Binance.
Do not install applications from unverified sources, and ensure your device is updated promptly. The security of your funds begins with the security of your phone.
Posts on X
A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.