Binance has warned that an Apple iOS vulnerability called worse_query could allow malicious applications to read files belonging to other apps, putting cryptocurrency recovery phrases, private keys and login credentials at risk. Decrypt reported the warning on November 10. As of November 11, 2026, its report described no confirmed cryptocurrency thefts using the flaw.
The exchange identified iOS 26.7.1, 27.0.1 and 27.2 among affected versions. It advised users to remove applications installed from untrusted sources and install official updates. For anyone who suspects a breach, its recommendation goes further: move funds to a new wallet created on a clean device and reset active login sessions.
The warning concerns access to sensitive files across application boundaries. For wallet holders, the consequences depend on whether those files expose usable secrets.
An application boundary becomes a route to wallet data
The researcher forcequitOS describes worse_query as a sandbox escape. Its public repository lists access to application data containers and several shared or system locations. The developer describes the release as a proof of concept that is not useful by itself.
The repository names iOS 26.0 through 26.7.2 and iOS 27.2, a broader version range than the exchange's warning. When checking a device, users should therefore treat Binance's three named versions as an incomplete list of the releases covered by the research.
A sandbox escape breaches the separation between applications. The crypto risk arises when crossing that boundary gives another application access to files containing wallet secrets. Reading a file and obtaining a usable private key are separate steps; the file's contents and protections determine the consequence.
Recovery phrases carry particular weight. MetaMask's documentation explains that importing a secret recovery phrase restores a wallet and its associated accounts, while importing a private key restores an individual account. Those credentials provide access beyond the original installation.
For users choosing self-custody options, control of the wallet also requires protecting the device and recovery material used to access it.
Apple's update leaves a specific question open
Apple released iOS 27.2.1 on November 9. Its security advisory lists an App Intents authorization issue through which an application may access sensitive user data, alongside fixes affecting Bluetooth, Messages and other components.
The advisory does not name worse_query or credit forcequitOS. Decrypt reported that SlowMist security chief 23pds said the update blocks the sandbox escape, but Apple had not publicly confirmed that connection. Apple's description identifies the App Intents issue by its own vulnerability identifier and credited researcher.
The timing leaves room for uncertainty: an update released shortly after a public proof of concept may address related functionality, a different vulnerability or several separate problems. Establishing which fix closes a named exploit requires a technical connection between the research and the update.
Users can still act on Binance's recommendation to install available security fixes while that connection remains unconfirmed. The recommendation gives them a concrete precaution to take without requiring a definitive answer about this particular flaw's patch status.
A copied recovery phrase requires a different response
Binance's instructions separate precaution from suspected compromise. Removing untrusted applications and updating software address the device. Moving assets to a new wallet addresses credentials that may already have escaped.
MyEtherWallet's security guidance explains why: a compromised recovery phrase cannot be reset or retroactively protected with a new password. Its advice is to discontinue the affected wallet and create another.
Reinstalling an application or importing the same phrase on a different phone does not accomplish that. MetaMask explicitly notes that importing an existing phrase changes the application used to access the assets without moving anything onchain. The same wallet remains accessible through the same recovery material.
If exposure is suspected, a replacement wallet therefore needs fresh recovery material. Restoring the old phrase into a clean installation preserves the credential that may have been copied, even though the user is accessing the wallet from a different device.
MyEtherWallet also warns against keeping recovery phrases in email, cloud services, messenger applications or other internet-connected storage. It recommends a written backup or a dedicated phrase storage device kept securely. That guidance concerns backup handling, a separate responsibility from installing an operating system update.
There is also a complication for wallets already showing theft. MyEtherWallet cautions that attackers may use automated software to remove incoming ETH intended to pay transaction fees. A recovery attempt can therefore require more care than sending additional gas to an affected address.
Overview
Binance's warning describes a possible route from a malicious iPhone application to sensitive files held by other apps. The public worse_query repository documents access to application data containers, while Apple's November 9 advisory leaves the named exploit's patch status unresolved.
Binance recommends two responses: remove untrusted applications and install official updates as a precaution; if compromise is suspected, move assets to a newly created wallet on a clean device, replacing the credentials that may have been exposed.
