Binance iPhone iOS Vulnerability Warning: worse_query
worse_query timeline: from researcher proof of concept to Binance's warning
| Date | What happened | Source type |
|---|---|---|
| Before Nov 2026 | Independent iOS researchers publish an earlier sandbox-escape technique called bad_query; worse_query is later described as its successor. | Researcher write-ups |
| Early Nov 2026 | A developer proof of concept for worse_query is published, covering iOS 26.0 through 26.7.2 plus iOS 27.2. A third-party file manager built on the same idea follows. | Public code repository and security press |
| Nov 9, 2026 | Apple releases iOS 27.2.1 and iOS 26.7.3. The published security notes do not mention worse_query. | Apple release notes |
| Nov 10, 2026 | Binance warns iPhone and iPad users that iOS 26.7.1, 27.0.1 and 27.2 are affected and tells them to remove untrusted apps and update. | Binance public notice |
| Nov 11, 2026 | A researcher states worse_query is not patched in iOS 27.2.1 or iOS 27.3 beta 1. No thefts have been reported. | Researcher statement reported by security press |
Binance iPhone iOS Vulnerability Warning: What worse_query Means for Your Crypto
On November 10, 2026 Binance warned iPhone and iPad users about an iOS flaw researchers call worse_query, which can let a malicious app read files that belong to other apps. Here is what is confirmed, which iOS versions are named, whether Apple has fixed it, and a practical checklist for anyone who keeps crypto on an iPhone.
Binance iPhone iOS vulnerability warning: the short answer
Binance posted a public warning on November 10, 2026 about an iOS weakness nicknamed worse_query. According to Binance, it could let malicious apps read local files from other apps on the same device, which may expose wallet seed phrases, private keys and login credentials. Binance named iOS 26.7.1, iOS 27.0.1 and iOS 27.2 as affected, on both iPhone and iPad.
The flaw sits in iOS itself, not in the Binance app, so any app that stores secrets in readable files could be exposed. Binance's advice is to delete apps installed from untrusted sources, such as sideloaded or manually signed IPA files, and to install the latest official iOS and app updates.
Two points matter most. First, neither Binance nor the researchers have reported any attack or crypto theft linked to worse_query so far. Second, the fix status is unclear: Apple shipped iOS 27.2.1 and iOS 26.7.3 on November 9, but their security notes do not name worse_query, and one researcher says it is still not patched in iOS 27.2.1 or the first iOS 27.3 beta.
How the iOS flaw reaches other apps' files (and what it cannot do)
iOS normally keeps every app in its own sandbox, a private folder other apps cannot open. worse_query is a sandbox escape: an app that has an App Group container can reach data belonging to other apps, including app data folders, extension data, some system service folders and shared App Group storage. No jailbreak is needed, which is why it matters for ordinary users.
The danger for crypto is simple. If a wallet or exchange app keeps a seed phrase, a private key or a login token in a plain file, a malicious app on the same phone could read it. Removing that app later does not help: a seed phrase that has been copied stays copied.
The limits matter too. Real exposure depends on what each target app writes to disk and whether that data has extra protection such as the iOS Keychain or the Secure Enclave. The public documentation does not show that worse_query can decrypt every wallet or bypass every credential protection, and the attacker still has to get a malicious app onto your device first.
Exchange app vs wallet app vs hardware wallet: who is exposed
| Where your crypto lives | What sits on the iPhone | Exposure to worse_query | What to do now |
|---|---|---|---|
| Exchange account (Binance, Coinbase and others) | Login session and app data; no seed phrase | A stolen session could allow account access, but withdrawals still face exchange checks such as 2FA and address whitelists | Log out of all sessions, turn on a withdrawal whitelist and a hardware security key |
| Mobile self-custody wallet (Trust Wallet and similar) | The wallet's keys or encrypted seed phrase | Highest if the app stores secrets in readable files; lower if keys live in the Keychain or Secure Enclave | Update the app; if you ever ran untrusted apps, move funds to a new wallet created on a clean device |
| Hardware wallet paired to the phone | Only public addresses and the companion app; keys stay on the device | Low: the phone never holds the private key | Keep the recovery phrase offline and verify every transaction on the hardware screen |
| Seed phrase saved in Notes, Photos or a screenshot | The full recovery phrase in plain form | Very high: plain files are exactly what this flaw can read | Treat the phrase as exposed: create a new wallet, move funds, then delete the copy |
iPhone crypto safety checklist after the Binance warning
| Check | How to do it | Why it matters |
|---|---|---|
| Check your iOS version | Open Settings, General, About and compare with 26.7.1, 27.0.1 and 27.2. | These are the versions Binance named as affected. |
| Install the latest update | Install the newest official iOS release and update every wallet and exchange app from the App Store. | Even if the fix is unconfirmed, newer builds close other known holes. |
| Delete untrusted apps | Remove sideloaded, enterprise-signed or manually signed IPA apps and any app you do not recognize. | The flaw needs a malicious app on the same device to work. |
| Get seed phrases off the phone | Delete recovery phrases stored in Notes, Photos, Files or screenshots and keep them on paper or metal. | Plain files are the easiest target for a sandbox escape. |
| Reset exchange sessions | Log out of all devices in your exchange security settings and sign back in. | It voids any login token that may have been copied. |
| Turn on withdrawal protection | Enable an address whitelist, a withdrawal delay and a hardware security key for 2FA. | A copied session then cannot move funds to an attacker's address. |
| Move funds if in doubt | If you ran untrusted apps on an affected version, create a new wallet on a clean device and transfer everything. | Deleting the bad app cannot revoke a key that was already read. |
| Ignore 'security fix' messages | Do not install tools or profiles sent by DMs, emails or fake support claiming to patch the bug. | Scammers reuse every security headline to push malware. |
Patch status and what to watch next
The key open question is whether Apple has closed worse_query. Watch the security notes of the next iOS release for a credit to the researchers or a fix for sandbox file access; until then, treat the flaw as unpatched on the versions Binance named.
For the market, this is a device-security story, not a sign of trouble at Binance itself. It lands about two weeks after the record October 29 Binance hack, which was traced to compromised internal systems, not to this iOS flaw. Headlines in quick succession can still weigh on sentiment toward BNB and exchange tokens, so watch exchange outflows rather than reacting to the headline.
If you trade through this period, keep long-term coins in cold storage and use Gemral's free crypto pattern scanner to check BTC, ETH and BNB structure before acting on news-driven moves.
Related research on gemral.com
| Page | What it covers |
|---|---|
| Binance CFO resigns after the hack | Leadership change after the October 29 breach and an exchange safety checklist. |
| Binance Hack Explained | How the October 29 breach happened and where the stolen funds went. |
| Claude Mythos and AI-driven vulnerability research | Why Anthropic limits its strongest model over its cybersecurity capabilities. |
| Agentic cybersecurity and threat detection stocks | Which security vendors benefit as attacks and exploits speed up. |
| Whale wallets and exchange outflows | How to read large on-chain moves off exchanges after a security scare. |
| Free crypto pattern scanner | Scan BTC, ETH and BNB for chart patterns and support levels. |
Access Real-Time Terminal Intelligence & Quantitative Signals
Unlock instant Telegram alerts, full congressional portfolio archives, and algorithmic catalyst radar.
Upgrade to Gemral Edge Pro ($39/mo)Frequently asked questions
What did Binance warn iPhone users about?
On November 10, 2026 Binance warned that an iOS flaw called worse_query could let malicious apps read files from other apps, which may expose wallet seed phrases, private keys and login credentials. It named iOS 26.7.1, 27.0.1 and 27.2 as affected.
Is the worse_query iOS vulnerability patched?
Not confirmed. Apple released iOS 27.2.1 and 26.7.3 on November 9, 2026, but the security notes do not mention worse_query, and a researcher says it is still not patched in iOS 27.2.1 or iOS 27.3 beta 1. Update anyway and watch the next release notes.
Has anyone lost crypto because of this iPhone flaw?
No theft has been reported. Neither Binance nor the researchers have linked any attack or crypto loss to worse_query so far. The warning is preventive.
Is the Binance app itself hacked?
No. The weakness is in iOS, so it can affect any app that stores secrets in readable files. Binance issued the warning to protect its users; it is separate from the October 29 Binance hack, which involved compromised internal systems.
What should I do if I hold crypto on my iPhone?
Update iOS and your apps, delete untrusted or sideloaded apps, remove seed phrases from Notes or screenshots, log out of exchange sessions and enable withdrawal whitelists. If you ran untrusted apps on an affected version, move funds to a new wallet created on a clean device.
Risk Disclaimer
Trading and investing in digital assets, financial instruments, and predictive events involve substantial risk of loss and are not suitable for every investor. The predictive intelligence, probability distributions, historical precedents, and scenario modeling presented on this page are compiled for informational and research purposes only and do not constitute financial, investment, legal, or tax advice. Past performance and statistical precedents do not guarantee future outcomes. Always conduct independent due diligence before committing capital.