Key Takeaways
- Binance warns that worse_query could allow malicious iOS apps to access sensitive files belonging to other applications.
- The vulnerability affects multiple iOS versions, although no confirmed cryptocurrency theft has been attributed to the exploit.
- Apple’s latest updates may block the technique, but the company has not explicitly confirmed a worse_query fix.
Binance Warns iPhone Users of Cross-App Data Exposure
Another security warning has rattled the cryptocurrency industry, this time involving a reported weakness in Apple’s iOS operating system that could compromise sensitive wallet information. On Nov. 10, Binance alerted users to the vulnerability through its official X account, identifying several affected software versions and recommending immediate precautions.
The exchange stated:
“A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.”
The distinction matters. Unlike an exchange-specific security breach, worse_query concerns the isolation mechanisms designed to prevent applications from accessing one another’s private files. A successful exploit could expose locally stored cryptocurrency recovery information, potentially allowing attackers to compromise wallets if the stolen material provides sufficient access.
Binance advised users to remove applications installed from untrusted sources, including sideloaded or manually signed IPA files, and update their devices and applications to the latest official releases. Users suspecting a compromise were also instructed to transfer their assets into newly created wallets on clean devices and terminate active login sessions.
What Is Worse_Query and How Does It Work?
Pseudonymous security researcher forcequitOS, working with researcher 0xjohnny, published a proof-of-concept on Github on Nov. 8, describing worse_query as the successor to an earlier technique called bad_query. The repository identifies affected versions spanning iOS 26.0 through 26.7.2 and iOS 27.2.
Technically, the vulnerability allows an application configured with an App Group container to access directories ordinarily protected by Apple’s application sandbox. These include application data containers, internal daemon directories, Pluginkit extensions, and shared App Group storage. Certain system directories on iOS 27 are also potentially accessible.
However, the researchers emphasized that their demonstration is not a complete attack tool or a traditional jailbreak. Exploitation requires additional malicious functionality, including an application capable of collecting accessible information. For cryptocurrency holders, the distinction between accessing files and stealing funds is particularly important.
Worse_query does not automatically drain wallets, and exposure depends partly on how individual applications store and protect sensitive information. Slowmist security executive 23pds similarly cautioned that the danger materializes when malicious software encounters wallet recovery information stored in a recoverable format.
As of Nov. 10, no confirmed cryptocurrency theft had been publicly attributed to worse_query.
Apple Updates Raise Questions About Patch Status
The tech giant Apple released iOS 27.2.1, iPadOS 27.2.1 and iOS 26.7.3 on Nov. 9, shortly after the proof-of-concept became public. The security documentation identifies nine fixes addressing several components, including AirPlay, Bluetooth, Messages, App Intents, and the brotli library.
However, Apple’s published notes do not explicitly identify worse_query or confirm that the sandbox escape has been eliminated. Slowmist’s 23pds has stated that iOS 27.2.1 blocks the technique, although independent confirmation from Apple remains outstanding.
Warning Follows Darksword Threat and Binance’s $6.3 Billion Hack
The advisory follows an Oct. 24 warning from Slowmist concerning Darksword, a separate iOS exploit framework targeting cryptocurrency users. Unlike worse_query, Darksword can exploit malicious webpages without requiring victims to install applications. Researchers identified more than 1,500 associated phishing sites impersonating exchanges, wallets, and other online services.
The warning also arrives less than two weeks after Binance’s Oct. 29 security breach, which involved approximately $6.3 billion in stolen cryptocurrency. That incident concerned compromised internal infrastructure rather than the iOS vulnerability or private key leaks. The two events have not been linked.
For cryptocurrency holders, the latest discovery illustrates how operating-system weaknesses can threaten assets even when blockchain networks themselves remain uncompromised. The immediate concern is not a demonstrated wave of theft, but the possibility that sensitive wallet credentials could become accessible through software users mistakenly trust.
