Editorial Team
4 min read
Binance warns iOS exploit could expose wallet keys; a fix remains unconfirmed
Binance warns that malicious iPhone apps could use worse_query to read other apps’ files. A file manager built on the public code demonstrates cross-app access, but no cryptocurrency losses have been confirmed and the latest Apple updates have not been linked conclusively to a fix.
- Binance says malicious apps could expose seed phrases, private keys and login credentials stored by other apps.
- A file manager built on the exploit requires installation on the iPhone; public code alone is not an attack.
- Updating remains Binance’s advice, but a fix for this specific exploit has not been confirmed.
Binance, the cryptocurrency exchange, warned on November 10 that a flaw in iOS, Apple’s iPhone operating system, could let malicious apps read other apps’ private files, potentially exposing wallet secrets and account credentials. Apple released security updates a day before the warning, but whether those updates close this specific technique remains unresolved.
The researcher’s disclosure preceded Apple’s updates and Binance’s warning; the sequence does not establish a worse_query fix. Source: Researcher’s post announcing worse_query.
An operating-system boundary at risk
In its warning, Binance named iOS 26.7.1, 27.0.1 and 27.2 and described the problem as an operating-system issue extending beyond its own app. It urged users to remove apps from untrusted sources, including sideloaded or manually signed installation packages, and update iOS and all apps to the latest official versions.
The concern is the separation between applications. A sandbox escape lets an app cross the security boundary around its own storage. Binance says the exposed material could include seed phrases and private keys. That warning does not establish that every wallet stores recoverable secrets in the files the exploit can reach.
The November 10 report said no cryptocurrency losses had been confirmed. The available evidence supplies no measured population of compromised devices or value of funds exposed, so it cannot support an estimate of financial damage.
