Binance has raised concerns about a critical security vulnerability affecting Apple devices that could expose cryptocurrency wallets, private keys, and sensitive account information. The flaw, known as worse_query, reportedly allows malicious applications to bypass restrictions and access files stored within other apps. The exchange has identified several potentially affected iOS versions and urged users to uninstall applications from untrusted sources.
The security issue is not limited to cryptocurrency software. Any application that stores confidential information locally could potentially expose passwords, authentication records, and personal documents. This makes the vulnerability particularly concerning for iPhone owners who use their devices to manage financial accounts and execute crypto transactions.
The reported exploit targets Apple’s application sandbox, a built-in security system that separates applications and prevents them from accessing one another’s private files. Under normal conditions, each app operates independently, ensuring that information stored within one application remains inaccessible to others without authorization.
However, the worse_query vulnerability reportedly defeats this separation. By bypassing sandbox restrictions, a malicious application could potentially reach directories containing sensitive information from other installed apps.
The public GitHub repository associated with the research describes worse_query as an iOS sandbox escape affecting versions of iOS 26 and iOS 27. Its documentation identifies affected releases from iOS 26.0 to 26.7.2, along with iOS 27.2.
According to Binance, the information potentially at risk includes cryptocurrency seed phrases, private keys, and account login details.
The severity of the threat also depends on how applications store confidential information. Wallets that keep recovery phrases or authentication credentials in locally accessible files could be particularly vulnerable.
SlowMist’s security chief has also raised concerns about the implications of the exploit, warning that it could undermine the expected protection provided by isolated application containers.
Binance Warning Raises Questions About Apple’s Latest Security Patches
Apple’s latest software releases have created additional uncertainty surrounding the reported vulnerability. Its security update records show that iOS 27.2 and iOS 26.7.2 were released on October 26, 2026.
However, Apple’s published security documentation does not specifically reference worse_query. Consequently, there is no clear public confirmation that these updates completely address the reported sandbox escape.
A separate GitHub project demonstrating the exploit claimed on November 8 that Apple’s available software versions had not yet fixed the vulnerability. This raises questions about whether installing the newest iOS release is sufficient to protect devices against this particular threat.
Binance recommends keeping iPhones updated with the latest official software and ensuring that installed applications are running their newest versions. The exchange also advises users to remove software downloaded from unfamiliar sources, including manually signed IPA applications.
For cryptocurrency investors, however, basic software updates may not be enough if a device has already been compromised. Users should consider whether sensitive wallet information could have been accessed and take additional precautions to secure their accounts and funds.
Earlier iPhone Exploits Also Targeted Cryptocurrency Credentials
The latest security alert follows several incidents involving malicious applications designed to compromise iPhone users and steal cryptocurrency-related information.
In September, Binance warned about FomoPeek, a third-party application whose versions 1.1 and 1.2 reportedly contained malicious code. Researchers found that the software could exploit weaknesses in iOS to gain elevated privileges on affected devices.
The potential targets included wallet recovery phrases, private keys, login credentials, and other sensitive information saved locally.
Another recent concern involved the DarkSword exploit framework, which CertiK reportedly identified as a threat to cryptocurrency applications through compromised websites and vulnerable iPhone devices.
Although these attacks use different techniques, they point to a growing security challenge for cryptocurrency holders who depend on mobile devices to access and manage digital assets.
The latest Binance warning highlights an important weakness in cryptocurrency self-custody. Protecting digital assets requires more than securing a wallet application. Recovery phrases, private keys, and login credentials must also remain protected wherever they are stored on a device.
