Binance warns iPhone crypto wallets vulnerable to iOS sandbox flaw

Binance warned on November 10 that a newly disclosed iOS vulnerability called worse_query could allow a malicious app to read files belonging to other apps, potentially exposing crypto wallet seed phrases and private keys. eSecurity Planet reported that the exchange named iOS 26.7.1, 27.0.1, and 27.2 as affected. Binance stated that exposed files might contain wallet seed phrases, private keys, and login credentials, and called the problem "an iOS-level issue, not unique to Binance," as reported by The Mac Observer.

Security researcher forcequitOS published working proof-of-concept code on GitHub on November 8. A developer named Christoph Kolbicz has turned the technique into a tool called WQ Files, which can open, back up, edit, and delete data from other apps, according to The Mac Observer. WQ Files can be installed only by sideloading, for example through tools like AltStore and SideStore. The primary vector is sideloading: apps obtained outside the official App Store, including through enterprise developer profiles, TestFlight builds, or alternative marketplaces. Apps that pass Apple's App Store review face "minimal immediate exposure," security analysts told PaidFreeDroid.

The exploit targets App Groups, which are shared folders that Apple allows a developer's related apps and extensions to use for exchanging data. Ostorlab explains that a malicious app replaces its App Group cache folder with a symlink pointing elsewhere on the phone, and the iOS service that grants folder access follows that shortcut without checking it still sits inside the app's own space. No jailbreak or kernel exploit is needed, and the technique works on iOS 26.0 through 26.7.2 and iOS 27.2, a wider range than Binance named.

Apple released iOS 27.2.1 on November 9, one day after the proof-of-concept appeared. The update's security notes list nine fixes, but none for the app sandbox or container system this bug abuses. Apple has not confirmed whether any of those fixes addresses worse_query, and the App Intents entry CVE-2026-113963, which says an app "may be able to access sensitive user data," has not been shown to close the hole. The update also addresses AirPlay, Bluetooth, two CoreUtils pairing bugs, two iMessage group chat flaws, and a brotli compression library issue.

So far, neither Binance nor the researcher has reported any attack or theft connected to the flaw, and BleepingComputer says there is no evidence that attackers have used it against cryptocurrency holders.

For iPhone owners with crypto wallets, Binance, Ostorlab, and Bitdefender agree on protective steps: delete any app you did not get from the App Store, remove unknown configuration profiles in Settings > General > VPN & Device Management, install iOS 27.2.1 to get the other security patches, and avoid storing recovery phrases in screenshots, Photos, or Notes. If you ran an untrusted app, create a new wallet on a clean device and move your funds immediately; an iOS update alone cannot invalidate an already exposed recovery phrase. A hardware wallet keeps keys off the phone entirely, Bitdefender suggests. The Mac Observer also notes that any message asking you to enter your seed phrase to "secure" your wallet following this news is a scam.