Binance warns iPhone users: public iOS exploit worse_query could expose wallet seed phrases

Short answer: On November 10, 2026, Binance warned that a publicly released iOS sandbox escape called worse_query lets malicious apps read local files belonging to other apps — files that can hold seed phrases, private keys and login credentials. The risk depends on a malicious app being installed, mostly via sideloading. No related thefts have been confirmed, and Apple has not said whether its latest updates close the hole.

What happened

Binance published the warning on X on November 10. The post itself could not be retrieved directly, so its wording here comes from coverage by BleepingComputer, Decrypt and CyberInsider.

The exchange named iOS 26.7.1, 27.0.1 and 27.2 as affected and described the bug as “an iOS-level issue, not unique to Binance.” In other words, this is not an exchange problem: any app that keeps secrets in readable files on an affected iPhone could, in principle, be exposed.

A day earlier, on November 9, Apple shipped iOS/iPadOS 27.2.1 and 26.7.3. No cryptocurrency thefts or losses tied to worse_query have been confirmed.

The exploit and its limits

What the researcher published

The code comes from a researcher known as forcequitOS, who posted it on GitHub. The README describes worse_query as a proof-of-concept sandbox escape for developers that “isn’t useful by itself,” states it has nothing to do with jailbreaking, and notes that it requires an App Group container.

The README lists iOS 26.0 – 26.7.2 / 27.2 — a wider range than the three versions Binance cited. Until Apple clarifies, treat the broader range as the cautious reference point.

A ready-made tool already exists

BleepingComputer reports that a file-manager app called WQ Files, built on worse_query, has been released and reportedly works on iOS 26.7.1, 27.0.1 and 27.2 without a jailbreak. It still has to be installed on the device, for example by sideloading.

Timelines differ between outlets: Bitcoin Magazine dates the GitHub release to November 8, while BleepingComputer says the WQ Files proof of concept appeared on November 9. These may be two separate releases.

The patch question

Apple’s security notes for iOS 27.2.1 and iOS 26.7.3 do not mention worse_query, a sandbox escape or App Group containers. The 27.2.1 notes do list CVE-2026-113963 in App Intents — “An app may be able to access sensitive user data” — credited to László Várady. Whether that entry is the worse_query bug is unconfirmed; BleepingComputer says it is unclear, and Apple had not answered its request for comment at publication.

SlowMist’s CISO, 23pds, urged users to move to iOS 27.2.1, saying it blocks worse_query, according to Decrypt. Bitcoin Magazine reports he said the risk arises only when an untrusted IPA is run and the wallet stores secrets in plain text. That is his assessment, not Apple’s.

What it means in practice

The threat model is narrower than the headline suggests. Two things need to line up:

• A malicious app on the phone. Reports point mainly to sideloaded or manually signed apps, not to the standard App Store route — though in-the-wild use through any channel has not been ruled out.
• A wallet that stores secrets in plain files reachable by the technique. Which wallets do this is not known.

If both conditions were met at any point, updating iOS afterwards does not help: an exposed seed phrase stays exposed, and the funds behind it should be moved.

Who is affected

Anyone running an affected iOS version who keeps a mobile crypto wallet, exchange app or saved logins on the device. The issue is global; no source singles out any country. For readers in Ukraine and Europe who rely on phone-based tools — whether the Binance app, a self-custody wallet holding coins bought via P2P or an exchange, or exchange accounts used for day-to-day operations after changes like Binance’s suspension of card withdrawals in Ukraine — the advice below applies equally.

The highest-risk group is users who install IPA files from outside the App Store.

Checklist for iPhone users

• Remove untrusted apps first. Delete anything sideloaded or manually signed, plus any app you don’t need or don’t trust (Binance’s advice).
• Update iOS to 27.2.1 or 26.7.3 as a precaution, as Binance and SlowMist recommend — keeping in mind that Apple has not confirmed this fixes worse_query.
• Update every app to its latest official version.
• Move larger holdings to a hardware wallet, which keeps private keys off the phone entirely — a mitigating factor noted by Bitcoin Magazine.
• If you suspect compromise, create a new wallet on a clean device, transfer your funds there and reset all active login sessions.
• Watch Apple’s security notes for any update that explicitly references this issue.

What is not yet known

• Whether iOS 27.2.1 or 26.7.3 actually fixes worse_query; Apple has not said.
• Whether worse_query has its own CVE, and whether CVE-2026-113963 is it.
• Whether it has been exploited in the wild, including via any App Store app.
• Which wallet apps store seed phrases or keys in plain files this technique can reach.
• The full original text of Binance’s post, which could not be retrieved directly.
• Whether forcequitOS reported the issue to Apple before publishing; the README is silent on this.

FAQ

Am I safe if I only install apps from the App Store?

Your risk is lower, since reports tie the exploit mainly to sideloaded or manually signed apps. But in-the-wild exploitation, including through App Store apps, has not been ruled out, so updating and pruning unused apps is still worthwhile.

Does iOS 27.2.1 fix worse_query?

Not officially. SlowMist’s CISO says it blocks the exploit, but Apple’s notes do not mention it, and the link to CVE-2026-113963 is unconfirmed.

Is this a Binance security breach?

No. Binance itself calls it an iOS-level issue that is not unique to Binance. It concerns data stored on the phone, not the exchange’s systems.

Does a hardware wallet protect me?

It keeps private keys off the phone, which removes them from the reach of an app-level file-reading exploit. Login credentials stored on the phone would still warrant attention.

Sources

Checked on 2026-11-10.

• Binance — security warning on X (post not directly retrievable)
• forcequitOS — worse_query on GitHub
• Apple — About the security content of iOS 27.2.1 and iPadOS 27.2.1
• Apple — About the security content of iOS 26.7.3 and iPadOS 26.7.3
• BleepingComputer — Binance warns of iOS flaw that could leak crypto wallet secrets
• CyberInsider — Binance warns iOS sandbox escape could expose crypto wallet secrets
• Decrypt — Binance Warns of Apple iOS Flaw That Could Expose iPhone Users’ Private Keys
• Bitcoin Magazine — Binance Warns iOS Flaw Could Expose Wallet Seed Phrases as Apple’s Latest iPhone Patch Stays Silent