Binance issued a security advisory on November 10, 2026 warning iPhone owners that a newly identified iOS vulnerability, labeled “worse_query”, could enable malicious applications to breach the operating system’s sandbox and access files belonging to other apps. The advisory highlights the risk that cryptocurrency wallet recovery phrases, private keys, and login credentials stored locally could be exposed if an app stores them in unprotected files.

Technical details of the worse_query flaw

According to the research repository that first published the proof‑of‑concept, the vulnerability allows an app to escape the iOS sandbox and read directories normally restricted to other applications. The flaw has been demonstrated on multiple releases of iOS 26 and iOS 27, specifically versions 26.7.1, 27.0.1 and 27.2. The author describes the exploit as a sandbox escape rather than a jailbreak, and notes that it is a developer proof‑of‑concept rather than a fully weaponized attack.

Potential impact on crypto wallets

If a wallet app stores recovery phrases, private keys or other sensitive data in files that are readable through the sandbox escape, a malicious app could retrieve that information. Binance stressed that the risk “extends across the entire ecosystem,” but also clarified that not all wallets keep credentials in plain files; many use encrypted storage, hardware‑backed keychains, or other mitigations that reduce exposure. No confirmed incidents of MetaMask, Phantom, Trust Wallet or other popular wallets being compromised via worse_query have been reported.

The exchange advises users to remove any applications installed from untrusted sources, especially manually signed or sideloaded IPA files. Updating the iPhone to the latest official iOS version is also recommended; Apple released iOS 27.2 on October 26 and a subsequent 27.2.1 update on November 9 that addresses several security issues, though Apple’s advisories do not explicitly reference worse_query. Users who suspect their wallet credentials may have been exposed should generate a new wallet on a clean device, transfer funds, and reset active login sessions.

What to watch next

The next steps to monitor include any official patch notes from Apple that specifically mention the sandbox escape, as well as follow‑up disclosures from security firms such as SlowMist or CertiK that may link the flaw to active exploit campaigns. Binance’s future communications and any reported incidents of wallet credential theft on iOS devices will also be key indicators of whether worse_query moves from proof‑of‑concept to real‑world threat.