Binance has warned iPhone users that an iOS sandbox escape called worse_query can let a malicious app read files that belong to other apps, putting any seed phrase, private key or login stored on the phone at risk.
The exchange posted the warning on X at 09:56 UTC on November 10, less than two days after the exploit code went public on GitHub. By early afternoon, the post had been viewed nearly 700,000 times.
Binance was clear that this is not a Binance bug. “This is an iOS-level issue, not unique to Binance,” the exchange wrote, adding that the risk runs “across the entire ecosystem.”
What worse_query actually does
Every iPhone app runs inside a sandbox, a walled-off folder that other apps are not supposed to see. That separation is why a game on your phone cannot normally read the files of your wallet app.
worse_query breaks that wall. The public repository, published by a developer under the name forcequitOS, says it can reach the data folders of installed applications, shared app group containers and several system locations.
The developer describes it as a proof of concept for developers that “isn’t useful by itself,” and says it is the successor to an earlier escape called bad_query. To use it, an app has to be built with an App Group container, which is a normal iOS feature.
In plain terms, someone still has to get a malicious app onto your phone. But once that happens, the app could read data that other apps keep in local storage.
For a crypto user, that local storage can hold a lot. Some wallets keep encrypted key material there, exchange apps keep session tokens, and many people keep screenshots or notes of their recovery words without thinking twice about it.
Which iPhones are affected
Binance named iOS 26.7.1, 27.0.1 and 27.2 as affected versions. The repository itself lists iOS 26.0 through 26.7.2 and iOS 27.2.
A separate customization project built on the same escape claims to work on even more releases, up to iOS 27.2.1 and the first iOS 27.3 beta. That is a third-party claim we could not test, but it is the reason the update question matters.
You can check which version your phone runs under Settings, then General, then About. If it shows any of the releases above, the warning applies to you.
Has Apple fixed it?
That is still unclear. Apple released iOS 27.2.1 and iOS 26.7.3 on November 9, roughly a day after the exploit code appeared.
Apple’s security notes for iOS 27.2.1 list nine fixes. Four deal with Bluetooth, AirPlay or network pairing bypasses, two with memory corruption and two with iMessage group chats.
Only one, in App Intents, is described as an issue where “an app may be able to access sensitive user data.” Apple does not name worse_query anywhere in the notes, so there is no public confirmation that this fix closes the sandbox escape.
Binance’s advice still includes updating iOS and every app to the latest official versions. That is sensible because updates close other holes, but users should not assume the update alone makes them safe from this one.
What Binance tells users to do
The exchange’s checklist is short. First, delete any app installed from an untrusted source, including sideloaded apps and manually signed IPA files.
Second, update iOS and all apps. Third, if you think your phone may have been compromised, move your funds to a new wallet created on a clean device and reset all active login sessions.
That last step matters most. Changing a password does nothing if an attacker already holds the seed phrase, because the seed phrase is the wallet. The only real fix is a new wallet with a new seed that has never touched the exposed phone.
Binance’s post did not report any thefts linked to the flaw. The danger right now is the gap between public exploit code and a confirmed patch.
Why Bitcoin self-custody still wins here
None of this is an argument against holding your own Bitcoin. It is an argument for holding it properly.
A sandbox escape can only steal what is sitting in a file on the phone. A seed phrase written on paper or metal, or a key kept inside a dedicated signing device, never lands in that folder in the first place.
We believe the practical lesson is to keep a phone wallet for spending money and move long-term savings to cold storage. The phone stays convenient, while the savings stay out of reach of whatever app you install next.
Mobile self-custody is growing fast. Telegram users alone opened 700,000 self-custodial wallets in 48 hours this month. As more people hold keys on their phones, basic habits will decide who keeps their coins.
Those habits are simple: install apps only from the official store, never type or photograph a seed phrase on a phone, and treat any app from a Telegram link or an unknown website as hostile until proven otherwise.
Bitcoin’s own security has not changed. The weak point in this story is the device, and that is something every holder can control.
DC Forecasts is a leader in many crypto news categories, striving for the highest journalistic standards and abiding by a strict set of editorial policies. If you are interested to offer your expertise or contribute to our news website, feel free to contact us at [email protected]
Discussion about this post