A critical security vulnerability in Apple’s iOS operating system has put iPhone users at risk, particularly those managing cryptocurrency wallets. Researchers say the flaw, known as “worse_query,” may allow malicious apps to access sensitive files, including wallet seed phrases and private keys, stored by other apps. Binance issued a public warning highlighting the danger to users who manage crypto assets on affected devices.
iOS flaw exposes key crypto data
The vulnerability was discovered by security researchers using the aliases @0xjohnny and @forcequitOS. They demonstrated that the flaw bypasses iOS sandbox rules, a core feature designed to keep each app’s data isolated. In current builds, including iOS 26.7.1, 27.0.1, and 27.2.1, apps can reportedly exploit the bug to read files belonging to other applications—potentially accessing highly sensitive data such as wallet backup phrases, private keys, and account credentials.
A proof of concept was published showing the exploit in action, and other developers have since created a file manager app capable of reading, modifying, and deleting files from other installed apps without needing to jailbreak the device. This ability raises the stakes for anyone using their iPhone as a wallet or storing authentication data for exchanges.
Despite being notified about the issue, Apple’s latest iOS updates have not addressed the vulnerability. Researcher @forcequitOS clarified that iOS 27.2.1 and the first beta of iOS 27.3 still leave the flaw unpatched. Apple’s official update documentation for iOS 27.2.1 does not mention a fix for worse_query, underlining the urgency for users to take additional security measures.
A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.
Binance guidance for users
In its public advisory, Binance urged iPhone users engaging with crypto to respond quickly. The exchange recommended deleting all apps sourced outside official channels or downloaded as manually signed IPA files. Binance also advised updating both iOS and all installed applications to their latest versions, even though researchers have noted the main bug remains present in current builds.
For individuals who suspect their device may have been compromised, Binance suggested transferring digital assets to a new wallet created on a clean, unaffected device. Additionally, the company recommended resetting all active login sessions to prevent unauthorized access with potentially stolen credentials.
Researchers have stressed that while proof-of-concept applications demonstrating this vulnerability are circulating, there have been no confirmed incidents of cryptocurrency theft or exploitation linked directly to this bug at this time.
Just as a general statement so there isn’t any confusion about it, worse_query is not patched in iOS 27.2.1 and 27.3 beta 1. The readme will be updated when it’s patched.
Security and monitoring tools for crypto holders
As the worse_query vulnerability highlights new risks for iPhone-based crypto wallet users, effective monitoring tools become increasingly important. CryptoAppsy provides real-time alerts and coin-specific news, making it easier for users to track potential threats and respond quickly to critical events. For anyone concerned about vulnerabilities or suspicious activity affecting their crypto holdings, these features can help improve security awareness and reduce the chance of loss.
