Binance Warning: iPhone Users should be aware of a vulnerability known as "worse_query". iOS This vulnerability may allow malicious applications to access files of other applications, potentially exposing cryptocurrency wallet credentials.

• Binance warns that worse_query may allow malicious applications to access files of other iOS applications.
• The exchange stated that iOS versions 26.7.1, 27.0.1, and 27.2 are affected.
• If an application stores recovery phrases and private keys in accessible files, the relevant information may be at risk of exposure.
• Apple's security announcement did not explicitly mention worse_query, nor did it confirm that a patch has been released to address this vulnerability.
• Binance It is recommended to delete untrusted applications and update your device; if you suspect that your wallet credentials have been compromised, you should change them.

In the security warning issued on November 10th, the exchange listed affected versions such as iOS 26.7.1, 27.0.1, and 27.2. It was indicated that this vulnerability could expose locally stored recovery phrases, private keys, and login information. It was also emphasized that the issue relates to Apple's operating system, and not just to Binance itself.

Binance Warning iOS Users, beware of the worse_query vulnerability

The vulnerability involves Apple's app sandbox (application sandbox), which is a security feature designed to prevent installed apps from accessing the private files of other apps without authorization.

According to the documentation of the worse_query research repository, this vulnerability allows an application to access directories that are typically restricted to other software. The publicly disclosed proof-of-concept covers multiple versions, including iOS 26 and iOS 27.

Researchers describe this issue as a sandbox escape, which means that the application may exceed its normal file access permissions.

The author of the repository describes worse_query as a developer's concept verification and states that this is not a form of jailbreak. The publicly available materials do not prove that this vulnerability has been used to steal cryptocurrencies.

However, Binance warns that if other applications store sensitive information in files that can be accessed through this vulnerability, malicious applications may be able to obtain this information.

In its announcement, Binance stated that the risks "span the entire ecosystem," including cryptocurrency wallets and other applications that store sensitive customer data.

The exchange recommends that users delete applications installed from untrusted sources, especially manually signed or sideloaded IPA files.

It is also recommended to update iOS and the installed applications to the latest official versions.

For users who suspect that their wallet credentials have been leaked, Binance recommends creating a new wallet on a clean device, transferring funds, and resetting the current login session.

Regarding this warning, User DUKE reiterated the exchange's advice to delete untrusted applications and replace wallet credentials that may have been compromised.

Encrypted wallet mnemonics may be at risk of exposure

The vulnerabilities disclosed this time affect applications that store sensitive information in locations that can be accessed after sandbox escape.

Cryptocurrency wallets may store encrypted key materials, account information, or other records on the user's device, depending on their security design.

If an application stores recovery phrases, private keys, or related credentials in readable local files, unauthorized access to these files may expose the relevant information.

However, the existence of 'worse_query' does not mean that every wallet will store sensitive credentials in this manner.

Wallets that use encrypted storage, hardware-supported security mechanisms, and independent authentication controls will have varying exposure risks depending on the implementation methods.

Existing research does not indicate that MetaMask, Phantom, or Trust Wallet have been confirmed to be invaded due to worse_query.

The warning regarding Binance continues a previous incident involving malicious iPhone applications, which were aimed at obtaining cryptocurrency credentials.

As previously reported by crypto.news, Binance issued a warning to users in September regarding versions 1.1 and 1.2 of FomoPeek at that time. Researchers discovered that these versions contained malicious code that allowed access to information beyond the normal permissions of the application.

Security company SlowMist has discovered that the affected software contains various methods designed to enhance access privileges on Apple devices.

The investigation indicates that the risks involve locally stored recovery phrases, passwords, and other account information.

Apple security update raises questions about patch status

Apple has released several security updates that cover the iOS versions mentioned in the Binance warnings.

Its security release records show that iOS 27.2 was launched on October 26, followed by iOS 27.2.1 being released on November 9.

Newer versions have fixed multiple vulnerabilities that affect user information and device security.

However, Apple's public security announcement did not explicitly mention 'worse_query', nor did it confirm the CVE number corresponding to this sandbox escape vulnerability.

Therefore, these announcements do not indicate whether the latest updates have completely fixed the specific access methods described by the researchers.

In another disclosure in September, Apple patched CVE-2026-86950, which is a vulnerability related to CoreGraphics that could potentially be exploited for directed purposes.

This issue involves the malicious construction of files and arbitrary code execution. There is no evidence to suggest that it is the same vulnerability as worse_query.

An announcement in October recorded security fixes for access to other files, including protective measures to prevent unauthorized access to sensitive information.

Apple's security documentation recommends keeping devices up to date, while Binance urges customers to avoid using applications from unknown publishers.

Previous iOS attacks had targeted encrypted wallets.

Cryptography and security researchers have documented other attacks targeting Apple devices, which involve malicious applications, compromised websites, and software designed to obtain wallet credentials.

On November 6th, CertiK warned that an updated DarkSword utilizing a framework might target encryption applications on iPhone that contain vulnerabilities.

Researchers pointed out that MetaMask, Trust Wallet, Phantom, Exodus, and Coinbase are all applications that are allegedly targeted by this framework.

CertiK indicates that some attacks may begin with users opening malicious websites from Safari, without the need to approve any encrypted transactions.

SlowMist had previously also warned that DarkSword activities involved compromised devices, as well as attempts to extract locally stored private keys.

These findings involve another set of exploits using a framework and do not prove that attackers have used worse_query to target cryptocurrency users.

crypto.news contacted Binance for further comments, but as of the time of publication, the exchange has not responded yet.