Binance warns iPhone users of security flaw that could expose crypto wallets

Cryptocurrency giant Binance is urging iPhone owners to update their devices after researchers disclosed an iOS vulnerability that could allow malicious apps to access sensitive information, including crypto wallet recovery phrases and private keys.

Binance has issued a security warning to iPhone users after researchers uncovered a vulnerability in Apple's iOS operating system that could let malicious applications access private files belonging to other apps.

The flaw, dubbed worse_query, could expose cryptocurrency wallet recovery phrases, private keys and login credentials, giving attackers a way to steal digital assets from affected devices.

The warning comes less than two weeks after Binance suffered a massive $6.3 billion cryptocurrency heist that US federal investigators attributed to North Korean hackers.

Key points

• Binance warns that an iOS vulnerability could expose cryptocurrency wallet secrets and login credentials
• The flaw allows malicious apps to bypass iOS security restrictions and access files belonging to other applications
• The vulnerability can be exploited without jailbreaking an iPhone
• No cryptocurrency thefts have been confirmed in connection with the flaw, and it’s not clear whether Apple's latest updates fully address it

Malicious apps can bypass iPhone security protections

In a security advisory on X, Binance identified iOS 26.7.1, 27.0.1 and 27.2 as affected versions, warning that the vulnerability could compromise sensitive information stored by cryptocurrency wallets and other applications.

The exchange emphasized that the weakness lies in Apple's operating system rather than in Binance's own software, meaning users of other cryptocurrency services could also be at risk.

iPhone applications normally operate within isolated environments, known as sandboxes, that prevent them from freely accessing data belonging to other apps.

The worse_query vulnerability allows an application to bypass some of these restrictions and access files it would ordinarily be prohibited from reading.

According to BleepingComputer, researchers have already published proof-of-concept code demonstrating the issue.

A separate tool, called WQ Files, uses the technique to browse, export, modify and delete other applications' data without requiring the device to be jailbroken.

An attacker would still need to get malicious software on the targeted iPhone, possibly by convincing its owner to install an application from an untrusted source.

For cryptocurrency owners, the consequences could be serious. A wallet's recovery phrase, also known as a seed phrase, can provide access to its funds. Anyone who obtains that phrase may be able to restore the wallet elsewhere and transfer its contents without the owner's permission.

However, the vulnerability doesn’t automatically expose every cryptocurrency wallet. The risk depends on how individual applications store and protect their sensitive information.

Has Apple fixed the vulnerability?

Apple released security updates on Nov. 9, including iOS 27.2.1 and iOS 26.7.3, addressing several vulnerabilities.

One of the patched issues, tracked as CVE-2026-113963, could allow an application to access sensitive user information.

However, Apple's published security advisories do not explicitly identify worse_query, and it remains unclear whether the updates fully address the sandbox escape described by researchers.

There have been no confirmed reports of cryptocurrency theft involving the vulnerability.

Binance nevertheless recommends users install the latest official iOS updates, keep their applications up to date and remove software from untrusted sources.

Another security scare for Binance after $6.3 billion crypto heist

The warning comes shortly after Binance fell prey to what has been described as the largest cryptocurrency theft on record.

As Bitdefender reported previously, the FBI attributed the $6.3 billion attack, carried out in late October, to North Korean state-sponsored hackers associated with the TraderTraitor group.

According to investigators, the attackers stole billions in digital assets, and Binance said its initial investigation pointed to a compromised employee laptop as a possible entry point.

The newly disclosed iOS vulnerability is unrelated to that incident.

How to protect your cryptocurrency wallet on an iPhone

Binance recommends several precautions to reduce the risk of exposure:

• Update your iPhone. Open Settings → General → Software Update and install the latest official iOS version available for your device
• Remove untrusted applications. Delete unfamiliar or unnecessary apps, particularly those installed through unverified sources
• Keep recovery phrases offline. Avoid storing wallet recovery phrases in screenshots, photos, notes or other unencrypted files on your phone
• Consider a hardware wallet. For substantial cryptocurrency holdings, a reputable hardware wallet can help isolate private keys from potentially compromised smartphones
• Act quickly if you suspect compromise. Create a new wallet on a trusted, clean device, transfer your remaining funds and revoke active sessions associated with affected accounts

Users should also be suspicious of unsolicited messages claiming that their cryptocurrency wallets are at risk and directing them to websites where they must enter recovery phrases.

Scammers frequently exploit security alerts and breaking news to impersonate legitimate cryptocurrency services. Neither Binance nor a legitimate wallet provider should require users to disclose their recovery phrase to verify an account or install a security update.

When in doubt, use Bitdefender Scamio. Our scam-fighting chatbot can help users assess suspicious investment messages, links and online offers before engaging with potential scammers.

For additional protection, Bitdefender security solutions can help detect malicious downloads, phishing websites, and other threats that criminals use to compromise cryptocurrency users.

Frequently asked questions (FAQ)

What’s the worse_query iOS vulnerability?

Worse_query is a security flaw that could allow malicious applications to bypass Apple's iOS sandbox restrictions and access files belonging to other apps. This could expose sensitive information, including cryptocurrency wallet recovery phrases, private keys and login credentials.

Can hackers steal cryptocurrency from my iPhone using this flaw?

Potentially, yes. If attackers exploit the vulnerability and obtain a wallet's private keys or recovery phrase, they may be able to access and transfer its funds. However, exploitation requires malicious code to run on the device, and there are no confirmed reports of cryptocurrency theft linked to worse_query.

Which iOS versions are affected?

Binance identified iOS 26.7.1, 27.0.1 and 27.2 in its security warning. Users should check for the latest available security updates rather than assume that versions not specifically mentioned are unaffected.

Has Apple fixed the worse_query vulnerability?

Apple released additional iOS security updates on Nov. 9, but its published advisories do not explicitly identify worse_query. It’s not clear whether those updates fully address the vulnerability. Users should install the latest available iOS version as a precaution.

Are Binance wallets the only ones at risk?

No. The vulnerability affects Apple's operating system rather than Binance's application specifically. Other cryptocurrency wallets and applications storing sensitive information could also be exposed, depending on how they protect their data.

How can I protect my cryptocurrency wallet on an iPhone?

Keep iOS and wallet applications updated, remove untrusted software, and avoid storing recovery phrases in screenshots, notes or unencrypted files. For substantial cryptocurrency holdings, consider using a hardware wallet that keeps private keys separate from your phone.

Is this vulnerability connected to the $6.3 billion Binance hack?

No evidence links worse_query to the $6.3 billion cryptocurrency theft attributed to North Korean hackers in October 2026. The incidents involve different security risks, although both highlight the importance of protecting cryptocurrency assets and the devices used to access them.

On topic:

FBI blames North Korea for $6.3 billion Binance crypto heist

Europol busts investment scam network spanning 50 countries, seizes over 100 servers

Apple patches older iPhones against ‘extremely sophisticated’ attacks leveraging CoreGraphics flaw