Binance warns of iOS flaw that could leak crypto wallet secrets

Binance issued an urgent security warning for iPhone users after identifying an operating system vulnerability in Apple iOS versions 26.7.1, 27.0.1, and 27.2. As detailed in BleepingComputer's report, the flaw allows malicious third-party applications to bypass platform defenses and read private files stored by other apps. The exposed data includes cryptocurrency seed phrases, secret keys, and login credentials across mobile devices.

This report details the worse_query sandbox escape technique, the emergence of the WQ Files exploit tool, and Apple's recent security update batch. It provides critical guidance for cryptocurrency investors and mobile users seeking to protect digital wallets against unauthorized local extraction. Readers will find verified remediation steps, including clean wallet migration procedures and operating system patching recommendations across affected versions.

01Operating system storage exposure across platforms

Binance clarified that the security weakness resides within Apple's mobile operating system rather than the Binance application itself. The underlying flaw, designated worse_query, affects iOS 26.7.1, 27.0.1, and 27.2 across consumer hardware. Because the vulnerability exists at the operating system level, any mobile application storing sensitive credentials on an unpatched device remains exposed to unauthorized reading by adjacent software.

According to Binance, the worse_query vulnerability allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. Although no cryptocurrency losses have been verified to date, the exchange cautions that exposure extends across all digital wallets. This architecture-level defect directly circumvents standard application sandbox boundaries.

02Emergency remediation and clean device migration

Binance urges iPhone owners to install the latest available system updates immediately as a critical precaution against local data leakage. Users are also instructed to review their installed software, removing any unnecessary and untrusted applications from their phones. Reducing the presence of unverified applications significantly narrows the potential attack surface on vulnerable iOS versions.

For situations where device compromise is suspected, Binance advises users to transfer their cryptocurrency holdings to a new wallet created on a clean device. Generating fresh cryptographic keys on an uncompromised handset ensures that exposed seed phrases cannot be used to siphon digital assets. Users should also reset all active login sessions across exchange accounts to invalidate cached authorization tokens.

03Technical mechanics of worse query sandbox escape

The underlying mechanism, termed worse_query, is a publicly disclosed iOS sandbox escape technique that bypasses standard operating system file restrictions. Apple designed iOS sandboxing to keep application data strictly isolated within private application containers. The worse_query technique allows an application to cross these security boundaries and access the private storage directories of completely different installed applications.

Under regular iOS operation, third-party software cannot inspect peer application containers without root access or specialized jailbreak modifications. The worse_query exploit eliminates these traditional security safeguards, granting unauthorized software the ability to read arbitrary application storage. Consequently, an unprivileged background process can traverse directory structures that normally require elevated platform permissions, exposing cryptographic keys.

04Sideloaded distribution of WQ Files exploit

A functional proof-of-concept exploit tool named WQ Files was published yesterday, demonstrating active implementation of the worse_query technique. The utility uses worse_query to browse, export, edit, and delete data stored by other installed applications on the target iPhone. Notably, WQ Files performs these intrusive filesystem modifications without requiring the device to be jailbroken.

To execute an attack, the WQ Files utility must be installed directly on the victim's hardware. Attackers can distribute the tool through untrusted channels as a sideloaded application, thereby bypassing the vetting process of Apple's official App Store. Security researchers confirmed that WQ Files successfully functions on iOS 26.7.1, 27.0.1, and 27.2, aligning precisely with Binance's advisory.

05Apple security updates and vulnerability correlation

On November 9, Apple released iOS security updates including versions 27.2.1, 26.7.3, and 18.7.12 to address nine distinct system vulnerabilities. Among these patches is CVE-2026-113963, a flaw that could allow an application to access sensitive user data without permission. The CVE-2026-113963 vulnerability was identified and reported to Apple by security researcher László Várady.

Várady discovered that the unauthorized data access in CVE-2026-113963 occurred through the App Intents system rather than shared App Group containers. It remains unclear whether CVE-2026-113963 represents the exact worse_query vulnerability that Binance warned users about. Apple has been contacted for comment and clarification regarding the precise relationship between the two security issues.