Binance warns iOS worse_query flaw may expose wallet keys
Original title: Binance Warns iPhone Users of Major iOS Flaw That May Expose Crypto Wallet, Private Keys
A public proof of concept describes a sandbox escape; Apple’s November 9 updates are not confirmed as a fix.
Binance warned on November 10 that worse_query could let malicious apps read other apps’ local files on iOS 26.7.1, 27.0.1, and 27.2, including seed phrases, private keys, and login details. Researcher forcequitOS published a developer proof of concept for iOS 26.0 through 26.7.2 and iOS 27.2 and said it is not a complete theft tool. SlowMist’s 23pds warned that untrusted IPA packages could expose unencrypted wallet files. Apple listed iOS 27.2.1 and 26.7.3 on November 9, without confirming a fix.
Unconfirmed: Apple’s November 9 listings of iOS 27.2.1 and 26.7.3 do not confirm that they fix worse_query.
- Binance said the issue is in iOS, not unique to Binance.
- The proof of concept requires an App Group container and documents file access, not theft.
- Readable wallet files do not necessarily reveal usable private keys.
- Binance advises deleting sideloaded or manually signed IPA files and updating iOS.
- Users who suspect compromise should move funds to a new wallet on a clean device.
Impact: Other apps’ files, including wallet secrets, may be readable
| Product | Affected |
|---|---|
| Apple iOS | 26.7.1, 27.0.1, and 27.2; researcher documents 26.0 through 26.7.2 and 27.2 |
- 1.Delete apps from untrusted sources, including sideloaded or manually signed IPA files.
- 2.Install official iOS and app updates without treating them as proof that exposed secrets are safe.
- 3.If a breach is suspected, move funds to a new wallet on a clean device and reset sessions.
From the original article
2 min read at cybersecuritynews.com
Binance has warned iPhone users about worse_query, an iOS flaw that could let malicious apps read files belonging to other apps. In its November 10 warning, the exchange named iOS 26. 7.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.