Binance has issued a security warning to iPhone users after researchers disclosed an iOS vulnerability that allows malicious applications to bypass Apple’s sandbox protections and access files belonging to other apps, potentially exposing cryptocurrency wallets and sensitive personal information.
The vulnerability, known as worse_query, affects devices running iOS 26 and iOS 27. Security researchers say the latest Apple software updates have not fixed the flaw, leaving users potentially exposed if they install an application capable of exploiting it.
The exploit can allow one iPhone app to access another app’s local storage without requiring a jailbreak, potentially exposing wallet recovery phrases, private keys and login credentials.
- Binance warned that worse_query could expose cryptocurrency seed phrases, private keys and account credentials stored in applications on affected iPhones.
- Researchers demonstrated that the vulnerability bypasses iOS sandbox restrictions without a jailbreak. They say iOS 27.2.1 and iOS 27.3 beta 1 remain vulnerable.
- No confirmed thefts have been linked to the exploit, but users are advised to remove untrusted apps and consider hardware wallets for substantial cryptocurrency holdings.
No confirmed cryptocurrency thefts or attacks involving worse_query have been reported. The disclosure nevertheless prompted Binance to advise users to remove untrusted applications, install official security updates and transfer funds to a new wallet if they suspect their device has been compromised.
How worse_query can bypass iPhone security protections
Apple’s iOS sandbox normally isolates applications from one another, preventing an app from accessing another application’s private files without appropriate permissions.
The worse_query vulnerability bypasses those restrictions, allowing an application with the necessary setup to access data containers belonging to other apps installed on the same device.
Security researchers using the names forcequit and 0xjohnny publicly released the proof-of-concept code on GitHub on November 8, 2026.
The technique is a successor to an earlier sandbox escape called bad_query and requires an App Group container to operate.
According to the researchers’ documentation, worse_query can access application data directories, shared App Group storage and certain internal system folders.
On iOS 27, the technique also reaches additional system-related directories.
The vulnerability affects the isolation between applications rather than Apple’s encryption of an entire device. An attacker would need to execute a malicious or compromised application on the affected iPhone.
The published proof of concept was intended for developers, but other programmers have already built applications that use the technique.
One example is WQ Files, a file manager developed by Christoph Kolbicz that can browse, export, modify and delete files belonging to other applications.
Unlike conventional iPhone jailbreak tools, WQ Files does not require a kernel exploit or a fully jailbroken device.
Which iOS versions are vulnerable to worse_query?
Binance specifically identified three affected software versions in its November 10 security alert: iOS 26.7.1, iOS 27.0.1 and iOS 27.2.
These versions correspond to releases tested by developers using the exploit. They are not necessarily the complete list of affected systems.
The original worse_query repository identifies a wider range, including iOS 26.0 through iOS 26.7.2 and versions of iOS 27.
Researchers have also reported that the exploit remains functional on newer software.
| iOS version | Reported status |
|---|---|
| iOS 26.0-26.7.2 | Listed as vulnerable by the developer |
| iOS 27.0.1 | Confirmed in public testing |
| iOS 27.2 | Confirmed in public testing |
| iOS 27.2.1 | Researcher reports vulnerability remains |
| iOS 27.3 beta 1 | Researcher reports vulnerability remains |
Apple released iOS 27.2.1 and iOS 26.7.3 on November 9, addressing several security issues, including vulnerabilities affecting iMessage and Bluetooth. However, the published security notes did not identify a fix for worse_query.
Researcher forcequit said worse_query remained unpatched in iOS 27.2.1 and iOS 27.3 beta 1, contradicting suggestions that installing the latest updates would eliminate the specific vulnerability.
Another researcher, 0xjohnny, described the issue as an unpatched zero-day. As of November 14, Apple had not publicly confirmed a fix specifically for worse_query.
Installing official software updates remains advisable for protection against other vulnerabilities, but users should not assume that updating alone resolves this particular flaw.
Can hackers steal Bitcoin and crypto from an iPhone?
The vulnerability raises particular concerns for cryptocurrency users because software wallets may store sensitive information locally.
If an attacker gains access to readable wallet files containing recovery phrases, private keys or authentication credentials, that information could potentially be used to access cryptocurrency accounts or transfer funds.
A seed phrase is particularly sensitive because it can allow someone to reconstruct a wallet on another device. However, the existence of worse_query does not mean that every cryptocurrency wallet is vulnerable to theft.
The actual risk depends on how an application stores and protects its private keys and whether the data accessible through the sandbox escape includes usable credentials.
Neither Binance nor the security researchers identified specific cryptocurrency wallet applications whose private keys had been successfully extracted.
Access to another application’s files does not automatically defeat additional protections such as hardware-backed key storage, encryption or authentication requirements.
The same vulnerability could expose other sensitive information stored in application containers, including account details and certain locally stored documents.
Researchers have not established that the technique allows unrestricted access to every password or secret protected by Apple’s security architecture.
Can malicious App Store apps exploit worse_query?
Initial security warnings focused on applications installed outside Apple’s official App Store, including sideloaded software and manually signed IPA files. These installation methods can allow users to run software that has not passed Apple’s standard application review process.
However, forcequit subsequently warned that an application distributed through the App Store could theoretically exploit worse_query if the attacker succeeded in passing Apple’s review.
This means the potential exposure is not necessarily limited to sideloaded applications.
The researcher said the exploit could be used by an App Store application, although the attacker would first need to get the malicious software approved.
No confirmed malicious App Store application exploiting worse_query has been publicly identified in the reporting available.
The distinction matters because the vulnerability itself operates at the iOS level rather than being confined to a particular cryptocurrency exchange or wallet provider.
Binance urges iPhone users to protect crypto wallets
Binance recommended several immediate precautions following the public disclosure.
Users should remove applications installed from untrusted sources, particularly manually signed or sideloaded software whose origins cannot be verified.
They should also install the latest official versions of iOS and their applications, even though the specific sandbox escape remains reportedly unpatched.
For users holding substantial cryptocurrency balances, storing private keys in a dedicated hardware wallet can reduce exposure to compromises affecting mobile applications.
Recovery phrases should not be stored in unencrypted notes, screenshots or other easily accessible files on a phone.
If a device is suspected to have been compromised, Binance recommends transferring cryptocurrency to a new wallet created on a clean device and terminating active account sessions.
Moving funds to a newly generated wallet is important if a recovery phrase may have been exposed, because changing an account password does not invalidate a stolen wallet seed phrase.
The warning follows Binance’s separate October 29 security incident, which resulted in more than $6.34 bn being committed to cover affected cryptocurrency assets.
US authorities attributed that earlier attack to North Korean hackers. No evidence has been presented connecting the Binance breach to worse_query.
The newly disclosed iOS vulnerability remains a separate security issue affecting the broader mobile application ecosystem.
Has Apple fixed the iPhone security vulnerability?
As of November 14, 2026, no confirmed Apple security update specifically addressing worse_query had been announced.
The public availability of exploit code increases the potential for malicious applications to incorporate the technique, although no confirmed criminal exploitation has been established.
The researchers’ demonstrations show that the normal separation between applications can be bypassed on affected devices.
Until Apple releases a verified patch, users remain dependent on precautions including limiting untrusted applications, protecting wallet credentials and using separate devices or hardware wallets for sensitive cryptocurrency operations.