SAN FRANCISCO, November 13, 2026 – Binance has warned iPhone users that a newly disclosed iOS security flaw could allow malicious applications to access private files belonging to other apps, potentially exposing cryptocurrency recovery phrases, private keys and login credentials. No confirmed cryptocurrency theft has been linked to the vulnerability.
The cryptocurrency exchange issued its warning on November 10 after security researchers disclosed a vulnerability known as “worse_query”, which could bypass security restrictions designed to keep applications on Apple devices isolated from one another.
Binance identified iOS 26.7.1, iOS 27.0.1 and iOS 27.2 among the affected versions.
The issue has also been documented by a security researcher operating under the name forcequitOS, whose publicly available GitHub repository describes a wider range of potentially vulnerable operating system versions.
Although Apple released additional security updates on November 9, researchers maintain that the specific vulnerability has not been resolved.
The warning is particularly relevant to cryptocurrency holders because compromised wallet credentials can allow attackers to gain control of digital assets. However, the severity of the exposure depends on how individual applications store and protect sensitive information.
How the iPhone Security Flaw Works
Apple’s iOS operating system uses a security mechanism known as application sandboxing.
Under normal circumstances, this system separates each application from others installed on the device, preventing unauthorised access to private files, account information and other sensitive data.
The worse_query vulnerability could undermine that protection.
According to the research published on GitHub, an application configured to exploit the flaw may be able to access data directories that would ordinarily be restricted to other applications.
This could allow unauthorised software to read or potentially modify files outside its designated storage area.
The researcher described the publicly released code as a proof of concept intended for developers rather than a complete attack tool.
Nevertheless, other developers have demonstrated that the technique can be incorporated into applications capable of accessing and manipulating information belonging to unrelated software.
One such application, identified as WQ Files, demonstrates the ability to browse, export, modify and delete application data without requiring a conventional iPhone jailbreak.
The vulnerability does not mean that an attacker can automatically access an iPhone remotely simply because the device is connected to the internet.
Successful exploitation through the demonstrated technique requires an application capable of using the vulnerability to be installed and executed on the affected device.
Security Researcher Identifies Wider Range of Affected iOS Versions
Binance’s original warning specifically identified three iOS releases:
- iOS 26.7.1.
- iOS 27.0.1.
- iOS 27.2.
However, the publicly available research suggests that the possible exposure extends beyond those versions.
The worse_query GitHub repository identifies iOS 26.0 through iOS 26.7.2, together with iOS 27.2, as affected.
The researcher behind the disclosure, identified publicly as forcequitOS, also reported that the vulnerability remained present in iOS 27.2.1 and the first beta version of iOS 27.3.
The published proof of concept requires an App Group container, a feature normally used to allow related applications to share information.
The precise range of affected versions and the availability of reliable protection will depend on subsequent technical testing and security updates.
Cryptocurrency Recovery Phrases and Private Keys at Risk
The potential consequences are especially serious for users who store cryptocurrency credentials on their phones.
Digital wallets rely on sensitive information, including private keys and recovery phrases, to authorise transactions and restore access to assets.
If attackers obtain usable copies of those credentials, they may be able to transfer cryptocurrency without the owner’s permission.
Depending on the application and the information stored on the device, the vulnerability could potentially expose:
- Cryptocurrency wallet recovery phrases.
- Private keys used to authorise digital asset transactions.
- Login credentials and authentication information.
- Private documents and messages stored by applications.
- Other sensitive information held in accessible local files.
The risk is not identical across every cryptocurrency wallet.
Some applications store sensitive credentials using encryption and other security controls that could prevent an attacker from obtaining usable information even if local files become accessible.
In comments to Crypto.news, a Binance spokesperson explained that recovery phrases, private keys and login information could be exposed where the relevant data is stored in plaintext or in another recoverable form.
The spokesperson also emphasised that the vulnerability concerns iOS application isolation rather than a weakness unique to Binance.
Binance Says No Confirmed Cryptocurrency Theft Has Been Linked to Flaw
Despite the potentially serious consequences, Binance has not identified any verified cryptocurrency theft involving worse_query.
A company spokesperson told Crypto.news that the exchange had not found confirmed incidents in which attackers used the vulnerability to gain access to cryptocurrency wallets or steal funds.
This distinction is important because the public disclosure of a working security technique does not establish that criminals have successfully exploited it against ordinary users.
The published research demonstrates a potential route for accessing information across application boundaries.
The actual impact on cryptocurrency holdings would depend on several factors, including whether malicious software was installed, what files were accessible and whether the wallet’s credentials were sufficiently protected.
The exchange has therefore urged precautionary action without suggesting that every affected iPhone or cryptocurrency wallet has already been compromised.
Apple Security Updates Do Not Confirm a Fix
Apple released iOS 26.7.3 and iOS 27.2.1 on Monday, November 9, alongside additional updates for older operating systems.
The updates addressed several security vulnerabilities affecting components including Bluetooth, messaging services and application permissions.
Apple’s published security information for iOS 27.2.1 also identifies CVE-2026-113963, an authorisation vulnerability in App Intents that could allow an application to access sensitive user data.
However, that issue is distinct from the technical mechanism described in the worse_query research.
Apple’s official security notes do not identify worse_query by name or confirm that the November 9 updates resolve it.
The researcher responsible for the public disclosure subsequently stated that the flaw remained unpatched in iOS 27.2.1 and iOS 27.3 beta 1.
As of November 13, an Apple-confirmed fix specifically addressing worse_query had not been established in the official security information reviewed.
Users should continue installing official iOS updates because they address other vulnerabilities, but should not assume that an update has eliminated this particular risk without confirmation.
Binance Advises Users to Remove Untrusted Applications
Binance has issued precautionary guidance intended to reduce the possibility of exploitation.
The exchange recommends the following measures:
- Remove untrusted applications: Delete software installed from unknown sources, particularly manually signed or sideloaded iPhone application packages.
- Install official security updates: Keep iOS and installed applications updated using Apple’s authorised distribution channels.
- Review potentially compromised wallets: If there is reason to believe sensitive recovery information has been exposed, create a replacement wallet on a trusted, uncompromised device.
- Transfer cryptocurrency where necessary: Move digital assets from a potentially compromised wallet to the newly created wallet, ensuring that new recovery credentials are used.
- Reset account access: Change affected passwords and terminate active login sessions where account compromise is suspected.
- Protect recovery information: Never disclose wallet seed phrases, private keys or verification codes to individuals claiming to offer security assistance.
The exchange also recommends reporting suspicious activity through official customer-support channels and preserving relevant records for investigation.
Users should be alert to fraudulent messages claiming to offer security updates or wallet recovery assistance, since such communications can themselves be used to steal cryptocurrency.
Warning Comes Amid Wider Cryptocurrency Cybersecurity Concerns
The worse_query disclosure comes amid heightened scrutiny of cyber threats targeting cryptocurrency exchanges, digital wallets and mobile devices.
Security researchers have separately reported malicious software and exploit frameworks designed to extract information from cryptocurrency applications on vulnerable devices.
The threat environment also includes activity attributed by investigators to North Korean-linked hacking groups, including TraderTraitor, which has been associated with attempts to compromise cryptocurrency-related organisations.
These are separate cybersecurity matters.
The available evidence does not establish that the worse_query vulnerability was developed or exploited by TraderTraitor or any other specific criminal organisation.
Nor has Binance identified confirmed wallet theft through the flaw.
The original account also refers to Binance’s assurances about covering losses from a separate North Korean-linked hacking incident. That reported commitment should not be interpreted as a guarantee covering every potential future loss arising from worse_query.
Users Await Confirmation of a Security Fix
The public release of worse_query has demonstrated a potential weakness in a fundamental element of Apple’s mobile security architecture.
For cryptocurrency holders, the concern extends beyond the possibility of unauthorised access to ordinary files because exposed recovery credentials could result in irreversible financial losses.
Nevertheless, no confirmed theft involving this particular vulnerability has been identified by Binance, and the extent of exposure varies according to the security protections implemented by individual applications.
Apple’s November 9 updates do not provide publicly confirmed remediation for worse_query, while the researcher who disclosed the flaw maintains that the vulnerability remains active in newer test versions.
Until its status is conclusively resolved, users are being advised to avoid untrusted applications, maintain current software and take additional precautions where wallet credentials may have been compromised.
The next significant development will be confirmation from Apple that the vulnerability has been addressed, together with any further technical findings about its scope and real-world exploitation.
