Binance warned on Tuesday, 10 November 2026, that a flaw in Apple's iOS could expose crypto wallet recovery phrases and private keys if a user runs a malicious app on an affected iPhone. The exchange named iOS 26.7.1, 27.0.1 and 27.2 as the affected versions.

The flaw, dubbed worse_query, lets a malicious app read local files belonging to other apps, breaking the separation that iOS normally enforces between applications. Binance said that could put seed phrases, private keys and login credentials at risk across the entire ecosystem, and stressed that it is an iOS-level issue, not one unique to Binance.

Blockchain security firm SlowMist flagged the issue earlier on Tuesday, saying a malicious app could read a wallet's recovery phrase if the wallet stores it unencrypted on the device. The researcher behind the flaw, who goes by forcequitOS, publicly disclosed it on Sunday, 8 November, crediting another researcher known as 0xjohnny. The disclosure was published as a developer proof of concept, and its author has said it is a sandbox escape, not a jailbreak.

What Binance told iPhone users to do

Binance urged users to delete any apps installed from untrusted sources, and to update iOS and all apps to the latest official versions. Users who suspect a breach has already occurred should transfer funds to new wallets created on clean devices, the exchange said.

Apple released iOS 27.2.1 and iOS 26.7.3 on Monday, 9 November, but it remains unclear whether either update fixes the flaw. Apple's published security notes for those updates do not explicitly identify worse_query or confirm a fix for it, so users on the latest versions cannot yet be certain they are protected.

No confirmed wallet thefts linked to the flaw

A Binance spokesperson told Cointelegraph that the underlying file-access risk may apply across the iOS ecosystem, but said the exchange had identified no confirmed cases where attackers used this bug to access cryptocurrency wallets or steal funds.

The risk depends on a user installing and running an untrusted app, such as a sideloaded app, that then exploits the flaw. A wallet's seed phrase, keystore file or browser cache could then be readable if it is stored locally without encryption. The flaw does not drain wallets by itself, and access to a wallet's files does not necessarily reveal usable private keys.

iPhone owners should remove apps they do not trust, keep iOS updated, and check Apple's security release notes for confirmation of a fix before assuming the issue is closed.