Binance Warns of Critical iOS Flaw Exposing Crypto Wallets
Binance has alerted iPhone users to a critical iOS vulnerability, dubbed worse_query, affecting specific versions, which could allow malicious apps to access sensitive data like private keys from crypto wallets.
Binance has issued a stark warning to iPhone users regarding a critical vulnerability within Apple's iOS operating system, identified as "worse_query." This flaw, affecting iOS versions 26.7.1, 27.0.1, and 27.2, poses a significant risk by potentially allowing malicious applications to bypass sandbox restrictions. These restrictions are designed to isolate an app's data from other applications on the device, acting as a crucial security boundary.
The core of the "worse_query" vulnerability lies in its ability to permit unauthorized access to the local files of other applications. This means that a malicious app, once installed, could potentially read sensitive information stored by legitimate applications. For cryptocurrency users, this is particularly alarming as it could expose critical data such as seed phrases, private keys, and login credentials, which are essential for accessing and managing digital assets.
While Binance emphasized that this is an operating system-level issue and not a flaw unique to their own platform or app, the implications for the broader iOS ecosystem are substantial. The vulnerability was detailed by researcher forcequitOS as a proof-of-concept, demonstrating a sandbox escape for specific iOS versions. The research outlines access to application data folders, shared App Group folders, and certain system locations, requiring an App Group container for exploitation.
It is crucial to understand that "worse_query" is described as a proof-of-concept and not a fully developed theft tool. The research repository documents file access capabilities rather than confirmed instances of cryptocurrency theft. Cybersecurity experts note that the actual risk depends heavily on how individual applications, especially crypto wallets, store and protect user secrets. Accessing an app's files does not automatically guarantee the compromise of usable private keys, as wallets may employ additional encryption or secure storage methods.
However, the potential for exposure remains a serious concern. Security analysts have warned that untrusted applications could leverage this access to expose wallet recovery phrases or keystores if they are stored without adequate encryption. This vulnerability does not enable automatic draining of wallets, but it significantly lowers the barrier for attackers to acquire the necessary credentials for such actions.
In response to the threat, Binance recommends that iPhone users exercise caution by deleting applications from untrusted sources, including sideloaded or manually signed IPA files. They also strongly advise keeping both the iOS operating system and all installed applications updated to the latest versions. Apple has released updates such as iOS 27.2.1 and 27.2.3, but it is not yet definitively confirmed if these specific updates fully patch the "worse_query" vulnerability. Users should install official updates promptly.
For users who suspect their device may have been compromised, Binance suggests immediate action. This includes moving any cryptocurrency funds to a new wallet created on a verified, clean device and resetting all active login sessions across affected services. Proactive security measures and vigilance are paramount in mitigating the risks associated with such system-level vulnerabilities.