Binance warns iPhone users that worse_query can expose wallet keys

Binance has warned iPhone users that an iOS flaw called worse_query can let a malicious app read other apps’ local files, including wallet seed phrases, private keys and login data, Wu Blockchain reported on 10 November. Binance said the problem sits in iOS itself and affects every app on the device, not only its own.

“Delete apps installed from untrusted sources, update iOS and all apps to the latest official versions, and if you suspect a compromise, move funds to a new wallet created on a clean device and reset all active login sessions.”

— Binance, Wu Blockchain

Quote source: Wu Blockchain, 10 November 2026, summarizing Binance’s alert.

What worse_query is

The researcher forcequitOS published worse_query on GitHub on 8 November as a sandbox escape for iOS 26.0 to 26.7.2 and iOS 27.2. iOS lets each app see only its own data. The code reaches into the folders where other apps keep their data and shared files. The researcher calls it a proof of concept for developers that “isn’t useful by itself,” and it replaces an earlier exploit, bad_query.

An attacker still needs you to install and run a malicious app. SlowMist, a blockchain security firm, stressed that the bug does not steal funds on its own. The risk is highest if you install apps outside the App Store, for example as sideloaded or self-signed IPA files, and if a wallet keeps its seed phrase in plain text on the phone.

Does iOS 27.2.1 fix it

Apple released iOS 27.2.1 and iOS 26.7.3 on 9 November. Its security notes list fixes in Messages, AirPlay, Bluetooth and App Intents, where an app “may be able to access sensitive user data.” Apple does not mention worse_query. SlowMist’s chief information security officer, known as 23pds, says 27.2.1 stops it, while another SlowMist note says neither Apple advisory confirms a fix. The researcher’s list of affected versions does not include 27.2.1.

Binance’s alert names iOS 26.7.1, 27.0.1 and 27.2. It did not give a version number to install, only the latest official release.

What to do with your wallet

If you keep crypto in an app on your iPhone, Trust Wallet included, take three steps today:

• update to iOS 27.2.1, or 26.7.3 on older models, and update every wallet app;
• delete any app you installed outside the App Store;
• if you ran such an app on a phone with a wallet, create a new wallet on a clean device and move the funds.

A hardware wallet keeps the keys off the phone, which makes this kind of bug far less dangerous. Our guide on cold wallets covers how to store a seed phrase, and our piece on exchange accounts explains passkeys and withdrawal whitelists.

Based on Binance’s alert as reported by Wu Blockchain, the worse_query GitHub repository and Apple’s notes for iOS 27.2.1, checked on 10 November 2026. Apple has not confirmed whether 27.2.1 blocks worse_query. Not financial or security advice for a specific device.