Binance warns that the iOS vulnerability worse_query may expose wallet seed phrases and private keys
Binance warned in a post on its official X account on November 10, 2026, that iOS has a vulnerability called worse_query, affecting iOS versions 26.7.1, 27.0.1, and 27.2. The vulnerability allows malicious apps to read other apps’ local files, potentially putting wallet seed phrases, private keys, and login credentials stored in app files at risk. Binance emphasized that this is an iOS system-level issue and not unique to the Binance app.
Binance advised users to take action immediately: delete apps installed from untrusted sources, such as sideloaded or manually signed IPA files; update iOS and all apps to the latest official versions; and if they suspect they have been compromised, transfer funds to a wallet newly created on a clean device and reset all active login sessions.
Original source:
Title: A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2... Publisher: Binance (@binance) Publication date: 2026-11-10 URL: https://x.com/binance/status/2120093246399430770 Source nature: Official announcement by the party involved Verification status: The full original post was actually read for this report. Verification date: 2026-11-10. Supporting content: Supports all core facts in the main text, including the vulnerability name, affected versions, the fact that malicious apps can read other apps’ local files and put seed phrases/private keys/login credentials at risk, that the issue is at the iOS level, and Binance’s specific protection advice.
ABAB AI Insight
worse_query was publicly disclosed as a proof of concept by security researcher forcequitOS on November 8, and was described as an app sandbox escape that can break file isolation between iOS apps. Binance issued its warning on November 10, naming the specific affected versions and making clear that the risk covers apps across the entire ecosystem that store sensitive data, not just its own platform.
Apple released iOS 27.2.1 and 26.7.3 security updates on November 9, but the public security advisories did not explicitly mention worse_query, so it is currently impossible to confirm from official channels whether the latest version has fully fixed the issue. Exploiting the vulnerability usually requires the user to proactively install and run a malicious app from an unofficial source.
For crypto users, if a wallet app stores seed phrases or private keys in plaintext in local files, a malicious app can read them and cause key leakage. Hardware wallets are not directly affected by this vulnerability because the keys do not reside in the phone’s file system, and paper backup seed phrases are also not directly affected, but users of software wallets should prioritize checking sideloaded apps and updating the system.
This kind of system-level sandbox issue is a reminder that mobile wallet security depends not only on the app itself, but also on the operating system’s isolation mechanisms. Users should prioritize installing apps from official channels, and if they suspect exposure, move assets to a new wallet immediately rather than relying solely on a system update.
ABAB News · Cognitive Law
Once a system-level file isolation vulnerability is disclosed with a PoC, exchanges will prioritize issuing cross-platform warnings to protect user assets.
When official security advisories do not explicitly name the vulnerability, users should not assume the latest update has fully patched it.