Binance Flags iOS Flaw That May Expose Crypto Wallet Keys

By Tom Whitfield

Apple released iOS 27.2.1 and iOS 26.7.3 on November 9, one day before Binance warned that a public iOS sandbox escape could expose cryptocurrency wallet recovery phrases and private keys.

The warning names iOS 26.7.1, 27.0.1 and 27.2 as vulnerable. It also covers locally stored account credentials and says the weakness “is in Apple’s operating system rather than its own application.”

What does worse_query actually allow?

The public proof of concept, named “worse_query,” covers iOS 26.0 through 26.7.2 and iOS 27 through 27.2. Apple’s sandbox normally isolates each application’s data, preventing one app from freely browsing another app’s files.

The proof of concept reaches directories holding application data, plug-in data, shared app groups and some system containers. That access gives a hostile app a possible route to inspect files that another app expects to remain isolated.

Wallet exposure depends on storage design. A wallet that leaves recovery information or key material in readable local files faces more risk than one using encrypted storage, hardware-backed protection or Apple’s Secure Enclave.

Researchers have not established that every wallet is vulnerable, and no confirmed theft has been publicly attributed to worse_query. The repository describes the code as a developer proof of concept, not a jailbreak or ready-made wallet-stealing tool.

Takeaway: The technique crosses app boundaries, but its effect on a wallet depends on how that wallet protects secrets.

Do Apple’s latest updates close the issue?

Apple’s November 9 security releases address several vulnerabilities involving sensitive user data, Bluetooth and system components. Neither advisory for iOS 27.2.1 nor iOS 26.7.3 names worse_query or assigns a confirmed CVE to the reported technique.

The repository’s affected-version list currently ends at iOS 26.7.2 and iOS 27.2, immediately before Apple’s latest stable releases. That sequence may mean the technique no longer works, but Apple has not confirmed that reading in its security documentation.

Binance advised users to install the latest official iOS release, update their applications and remove software obtained from untrusted sources. Exploitation requires malicious code to run on the device, which makes sideloaded and manually signed applications a particular concern.

Takeaway: Installing the newest build is prudent, but the absence of an explicit Apple advisory prevents treating it as confirmed closure.

Why are crypto wallets a high-value target?

A recovery phrase or private key can give an attacker direct control of assets without access to a bank or exchange account. Unlike a conventional login password, a compromised wallet secret generally cannot be reset after funds move.

Earlier this year, Apple removed a fraudulent Ledger application linked to about $9.5 million in cryptocurrency theft. That case did not rely on worse_query or any sandbox escape; victims entered their recovery phrases into a fake app.

The episode nevertheless showed why attackers value credentials entered or stored on consumer devices. FinanceFeeds also recently covered a Trust Wallet warning involving an iOS zero-day, showing how an operating-system flaw can affect self-custody even when the wallet app was not the initial attack route.

A separate concern involves older iPhones that may carry hardware-level vulnerabilities ordinary software updates cannot fix. Exploiting those hardware weaknesses would not automatically reveal wallet credentials, so they present a different risk from the publicly documented software technique.

Takeaway: Wallet secrets concentrate financial control in a device, turning a software-isolation failure into a potential loss of funds.

What should users do if compromise is suspected?

Binance advised users who believe a malicious app may have accessed their device to “create a new wallet on a clean device and move their assets,” rather than relying only on deleting the suspect app. They should also end active sessions and replace any potentially exposed login credentials.

That response matters because patching iOS cannot invalidate a private key or seed phrase that an attacker has already copied. Moving funds to a new wallet can place them beyond the thief’s control; changing a password or removing an app cannot do the same for a stolen key.

Takeaway: For self-custody, users who suspect key exposure need new keys and clean devices, not merely a software update.