Mentioned in This Article
1. What is the iOS worse_query flaw?
The iOS worse_query flaw is a sandbox-escape vulnerability that, according to Binance, could let a malicious app read files stored by other apps on an iPhone. In a warning posted on X on Tuesday, November 10, the exchange said the exposed material could include crypto seed phrases, private keys and login credentials, and it listed iOS 26.7.1, 27.0.1 and 27.2 as affected versions.
Binance stressed that the problem sits in the operating system rather than in any single application. In its words, this is an iOS-level issue and is not unique to Binance. That framing matters for crypto users, because the same weakness would apply to any wallet, exchange or authenticator app that keeps sensitive data in its local storage on an affected phone.
Apple has not publicly confirmed that the flaw exists or that it has been fixed. The company released iOS 27.2.1 on Monday, November 9, a day after the proof of concept appeared online, but its published security notes make no mention of worse_query. That leaves a gap between the exchange's urgent warning and the manufacturer's silence, and it is the main reason the story is still developing.
For readers who hold crypto on a phone, the distinction between a flaw in one app and a flaw in the operating system is important. An app-level bug can be fixed by that developer alone, and users of other apps are unaffected. A weakness in the operating system's sandbox, by contrast, can only be closed by the platform owner, and every app on the device depends on that fix arriving. This is why Binance chose to speak publicly about a problem it does not control.
The timing adds to the concern. The proof of concept appeared on GitHub, where anyone can read it, and Apple's update followed within a day. Public code of this kind can shorten the time between disclosure and attempted abuse, because less capable attackers can adapt published material instead of building an exploit from scratch. That is the logic behind urging users to update promptly even when no theft has been recorded.
2. How does the exploit work?
Apple's mobile operating system isolates each app in a sandbox, a protective boundary that prevents one program from opening another program's private files. A sandbox escape is a bug that lets code break out of that boundary, and it is one of the more serious categories of mobile vulnerability because so much of an iPhone's security model depends on it.
The vulnerability was published on GitHub by a researcher who goes by the name forcequitOS. The repository describes worse_query as a sandbox escape affecting iOS 26.0 through 26.7.2 and iOS 27.2. It says the exploit can reach the folder where iOS apps store their data, which is precisely the location where wallet software often keeps encrypted key material, session tokens and cached account information.
The repository also calls worse_query the direct successor to an earlier exploit named bad_query. The researcher describes the release as a proof of concept that is not useful by itself. That qualification is significant: a proof of concept demonstrates that a flaw can be triggered, but turning it into a practical attack normally requires an attacker to deliver code onto a victim's device and to work out how to use the access it provides.
No confirmed crypto thefts linked to the flaw have been reported. Binance's message is therefore best read as a precaution based on the public availability of the proof of concept, not as a report of active losses.
3. Which versions of iOS are affected?
The versions named in the warning differ slightly depending on who is describing them. Binance listed iOS 26.7.1, 27.0.1 and 27.2. The researcher's repository describes a wider span, covering iOS 26.0 through 26.7.2 together with iOS 27.2. Users on any release in those ranges should treat the issue as relevant until Apple states otherwise.
Apple's iOS 27.2.1 release contains nine fixes according to its security notes. Among them is an App Intents authorization issue that could allow an app to access sensitive user data, along with fixes for Bluetooth and iMessage flaws. None of the listed items refers to worse_query or credits its discoverer. Because an App Intents problem involves an app gaining access to data it should not see, some observers may suspect a connection, but nothing in Apple's notes establishes one.
The practical conclusion is a cautious one. Installing the latest update is sensible regardless of whether it addresses this specific bug, since it contains nine documented security fixes. What users cannot yet assume is that the update closes the hole Binance described, because the manufacturer has neither confirmed nor denied it.
Applying the update itself is simple. On an iPhone, users can open the Settings app, choose General and then Software Update, and install the newest release offered. Keeping automatic updates switched on shortens the delay between Apple publishing a fix and a device receiving it, which is useful when a vulnerability becomes public before a patch is widely installed.
4. What does Binance advise iPhone users to do?
Binance offered a short list of steps. First, delete any app that came from an untrusted source, meaning software that was sideloaded or manually signed rather than installed through Apple's official store. Second, update iOS and every installed app to the latest version. Third, for anyone who suspects their device was compromised, move funds to a new wallet created on a clean device and reset all login sessions.
The reasoning behind the first step is straightforward. A sandbox escape is only useful to an attacker who can get a malicious app running on the phone, and apps from outside the official store are the most plausible delivery route for that. Removing them narrows the opportunity, even though it does not address the underlying operating-system weakness.
The third step reflects a basic rule of crypto security. A seed phrase or private key that may have been read by another program should be treated as exposed, because the holder cannot tell whether a copy exists elsewhere. Creating a new wallet on a trustworthy device and transferring funds to it is the only reliable way to restore control, and resetting login sessions ends any access gained through stolen tokens.
Binance's own advice to update every installed app, and not only the operating system, rests on similar thinking. Developers of wallet and exchange software sometimes add protections of their own, such as additional encryption of stored data, in response to platform-level problems. Running outdated versions can leave users without those safeguards.
5. What do security experts say about the update?
The only outside assessment in the available reporting comes from 23pds, the chief information security officer of blockchain security firm SlowMist. He urged users to update to iOS 27.2.1 and said the update would block the worse_query sandbox escape as well as other threats. His position is stronger than Apple's own notes, which are silent on the matter, and it suggests that analysts who have examined the release believe it closes the hole.
Even so, the lack of confirmation from Apple means users should rely on the combination of steps rather than on a single assurance. Updating the operating system, removing sideloaded software and keeping large holdings in a dedicated hardware wallet or another storage method that does not sit on the phone all reduce exposure in different ways.
Security specialists commonly recommend separating the devices and tools used for everyday browsing and messaging from those used to hold substantial funds. A phone that installs many apps from many sources has a large attack surface, whereas a dedicated device or a hardware wallet that never runs unrelated software has a much smaller one. Binance's suggestion to recover on a clean device points in the same direction.
6. Why does this matter for crypto users?
Mobile phones have become a main way to hold and move digital assets, and their security rests on the operating system's isolation of apps. When that isolation fails, every secret kept on the phone is potentially at risk at once, whether it belongs to an exchange account, a self-custody wallet or a password manager.
The warning arrives against a backdrop of earlier attacks on the same platform. Earlier this year, Google warned about iOS malware targeting crypto applications on devices that had not been patched. In August, the Dutch national cyber agency reported that hackers had exploited a flaw in the macOS Screen Sharing feature to install Monero miners on Macs. Those cases involved different bugs, but they show that Apple devices are a recurring target for attackers interested in cryptocurrency.
7. What happens next?
The key open question is whether Apple will state that iOS 27.2.1 fixes worse_query. A published acknowledgement, an updated security note or a credit to the researcher would settle the matter. Until then, users are left with the exchange's advice and one security executive's view that the update blocks the escape.
Anyone who has not yet installed iOS 27.2.1 has an immediate action to take, and anyone who has installed untrusted apps on an affected device should consider the precautionary steps Binance outlined. No further timetable has been announced, and the researcher's description of the release as a proof of concept suggests that the practical risk depends on whether attackers can combine it with other techniques.