Binance Warns iOS Flaw Can Expose Crypto Seed Phrases

Binance has warned that a security flaw in three iPhone software versions lets malicious apps read files stored by other apps, putting crypto seed phrases, private keys and login details at risk.

The exchange named the flaw "worse_query" in a post on X. It identified iOS 26.7.1, 27.0.1 and 27.2 as the affected versions. A seed phrase is the list of words that restores a crypto wallet, so anyone who obtains it can take the coins.

What does the flaw actually do?

The flaw works at the level of Apple's operating system. Binance called it "an iOS-level issue, not unique to Binance," placing the problem in the iPhone's software rather than in the exchange's own app.

The attack requires a malicious app on the phone. Once present, that app can read files belonging to other applications. Notes, photos and screenshots that contain a seed phrase are files, and a harmful app can read them under the flaw.

KuCoin issued a similar advisory. The rival exchange warned that users' wallet recovery details might be exposed on the affected versions.

Users can check their iPhone's software version under Settings, then General, then About.

Has Apple responded?

As of November 10, Apple (NASDAQ: AAPL) had released no statement and no patch for the worse_query flaw. The company typically holds back comment on security issues until a fix is generally available.

That stance leaves users on the three flagged versions without a vendor-side remedy for now. Once Apple releases a patch, an iPhone update could close the security gap.

How can users protect seed phrases?

Until Apple ships a fix, Binance advises users to uninstall apps from untrusted sources, because the flaw needs a malicious app on the phone to function.

The safest place for a seed phrase is offline. Binance's guidance draws a clear line between storage types:

• Notes, photos and screenshots on a phone are files that harmful apps can read.
• A seed phrase written on paper or engraved in metal stays out of reach of any app.

A hardware wallet also keeps private keys off the phone. Binance's advisory, as relayed in the report, recommends buying one directly from the manufacturer rather than through intermediaries.

Are phones the only weak point?

No. Recent incidents show that other links in the chain can fail even when a device is secure.

Revolut handed over customer passport and Bitcoin records in response to a fake government request, an episode reported in September. In October, hackers who bought a Ledger reseller sold tampered hardware wallets to customers. In August, the Coldcard hack showed that hardware wallets themselves carry risk, in an incident tied to $70 million.

An offline seed phrase stays safe on every iOS version, whether or not a patch arrives. Such a backup also serves a second purpose: it gives family members a way to reach the coins if the owner dies.

What happens next?

Binance and KuCoin have flagged iOS 26.7.1, 27.0.1 and 27.2, and Apple has confirmed nothing yet. Users on those versions should avoid untrusted apps and move any seed phrase stored in notes, photos or screenshots offline, since an iPhone update closing the gap will come only when Apple decides the fix is ready.