Binance issued a warning to iPhone users on Tuesday about a security vulnerability known as “worse_query,” which allows malicious applications to access local files belonging to other apps. The exchange stated that the flaw could put seed phrases, private keys, and login credentials at risk across a wide range of apps within the iOS ecosystem.
Vulnerable iOS Versions Identified
According to Binance, the affected iOS versions include 26.7.1, 27.0.1, and 27.2. The exchange emphasized that the issue originates from iOS itself rather than any Binance-specific application. Binance co-founder Yi He reposted the alert shortly after its initial release, reiterating the instructions and precautions for users.
The exchange highlighted that this is not an isolated incident impacting only Binance users. Instead, it is a platform-level vulnerability that could affect any app processing sensitive data on impacted versions of iOS.
Binance’s notification to the community comes during a time of heightened concern over digital asset security following a series of industry breaches.
Security Recommendations and User Guidance
In its guidance, Binance recommended users immediately delete any applications installed from untrusted sources, such as sideloaded or manually signed IPA files. These are iOS application packages loaded from outside the official App Store, often bypassing Apple’s standard security filters.
Additionally, users were instructed to ensure both their operating system and all apps remain updated to the latest official versions. Binance advised individuals who suspect their information may have been compromised to move their funds to a new wallet on a different, clean device and to log out from all sessions associated with previous devices.
Binance warned iPhone users that “worse_query” could expose seed phrases, private keys, and login credentials, and advised caution with apps from untrusted sources.
Origin and Mechanism of the Flaw
The vulnerability traces back to a proof-of-concept released by a developer known as forcequitOS. This code demonstrates a sandbox escape, the process by which a malicious app could evade the isolated storage system that Apple’s iOS assigns to each app. The published code is said to affect iOS versions 26.0 through 26.7.2, as well as 27.2, which aligns with some but not all of the versions identified by Binance.
Mini dictionary: Sandbox escape — A security exploit that allows a program to break out of its restricted environment, enabling access to other apps or the main operating system. This defeat of application isolation can threaten sensitive data stored by other apps.
The developer described the proof-of-concept code as not inherently useful on its own, specifying that it requires access to an App Group container. This feature allows related apps from the same developer to share files, which regular apps do not access by default. The vulnerability builds upon an earlier exploit known as bad_query, suggesting a lineage of similar attacks.
Apple’s Response and Recent Incidents
Apple released iOS 27.2.1 on November 9, addressing nine separate security issues. However, none of the fixes in the security notes refer to the worse_query vulnerability. The exchange’s warning comes just days after Binance’s hot wallets were compromised, leading to a significant outflow of approximately $6.3 billion.
| iOS Version | Binance Listed as Vulnerable | Proof-of-Concept Coverage |
|---|---|---|
| 26.7.1 | Yes | No |
| 27.0.1 | Yes | No |
| 27.2 | Yes | Yes |
With the attack vector still under analysis and Apple yet to officially acknowledge or patch the issue, Binance’s rapid alert represents the latest effort by major crypto exchanges to safeguard user assets against evolving mobile security threats.
