Binance Warns iOS Flaw Could Expose Crypto Wallet Secrets

Binance warned on Tuesday-scale disclosure that a vulnerability in Apple iOS 26.7.1, 27.0.1 and 27.2 lets third-party apps read private files stored by other apps, including cryptocurrency seed phrases, private keys and login credentials. The exchange urged users to patch immediately. No confirmed cryptocurrency losses have been reported so far, according to the company's advisory.

Binance stressed the defect sits at the operating-system level and does not affect only the Binance application. "A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem," Binance said in its statement.

What is the 'worse_query' technique?

"Worse_query" is a publicly disclosed iOS sandbox escape technique (a method that lets an application cross security boundaries and reach another app's storage). A proof-of-concept exploit was published yesterday, one day after the warning's subject versions were identified. It relies on a tool called WQ Files.

WQ Files uses "worse_query" to browse, export, edit and delete other apps' data without requiring a jailbreak (the removal of Apple's iOS software restrictions). The tool must be installed on the target iPhone for the attack to succeed. An attacker could distribute it as a sideloaded app (installed outside Apple's App Store) through untrusted sources, bypassing Apple's review process. WQ Files has been confirmed to work on iOS 26.7.1, 27.0.1 and 27.2 — the same versions named in Binance's warning.

What did Apple fix on November 9?

Apple released iOS security updates on November 9 covering iOS 27.2.1, 26.7.3 and 18.7.12. The batch addresses nine flaws. One of the patched vulnerabilities, tracked as CVE-2026-113963, could allow an app to access sensitive user data. It remains unclear whether this is the same security issue Binance flagged in its advisory.

The CVE-2026-113963 flaw was reported by researcher László Várady, who found that the unauthorized access occurred through App Intents — Apple's framework that lets apps expose functions to other apps and system features — rather than through App Group containers (shared storage compartments between applications).

BleepingComputer has contacted Apple for clarification and comment and will update its coverage once the company responds.

What should affected users do now?

Binance issued concrete remediation steps for iOS users holding crypto assets or other sensitive data on their devices. The company recommends immediate action on three fronts:

• Install the latest iOS version and update all other installed applications.
• Delete unnecessary and untrusted apps from the device.
• Where compromise is suspected, transfer funds to a new wallet created on a clean device and reset all active login sessions.

The warning carries weight beyond one exchange. Because the technique reads local files across application boundaries, any app storing credentials, documents or keys on affected iOS versions falls within the attack surface. Enterprises managing fleets of iPhones should verify device OS levels against the affected list and treat sideloaded applications as a primary infection vector.