Binance warns iPhone users of unpatched crypto hack

Binance posted a warning on its official X account on November 11, alerting iPhone owners to a serious iOS flaw that could expose cryptocurrency wallets stored on the device.

Binance alerts iPhone users

The exchange described the problem, tracked as “worse_query,” as a bug that lets any app read local files belonging to other apps. It affects iOS versions 26.7.1, 27.0.1 and 27.2, according to the notice.

Security researchers @0xjohnny and @forcequitOS disclosed the issue and posted a proof-of-concept on GitHub.

Other developers have already built on that code. A file-manager app was confirmed to use the technique to access, modify and delete data from unrelated apps, proving the exploit works in the wild.

For crypto holders, the risk is acute. Wallet applications often keep seed phrases, private keys and login tokens in local storage. Anyone who can read those files could reconstruct a wallet and move every asset out.

Binance recommends three immediate actions: delete any apps installed from untrusted sources such as sideloaded IPA files, update iOS and all apps to the latest releases, and, if a breach is suspected, move funds to a new wallet on a clean device and reset all active sessions.

Apple’s update lacks a fix

Apple’s most recent public security update, iOS 27.2.1, addressed a range of issues but made no mention of the “worse_query” bug. The release notes published on November 10 list no sandbox-escape patches.

Researcher @forcequitOS confirmed on X that the bug remains unpatched in iOS 27.2.1 and also in the currently available iOS 27.3 beta 1 developer preview. “I’ll update version support on the readme when it is patched,” the tweet read.

Apple has not issued any public comment about the flaw, nor indicated whether a fix is in development or when it might be released.

At the time of writing, neither Binance nor the researchers have documented any confirmed thefts directly tied to the exploit. The existence of a working public proof-of-concept and functional apps built on the method, however, leaves the threat surface open.

Why the flaw targets only iOS devices

The sandbox model on iOS isolates each app’s file system from others, relying on strict permission checks. The discovered vulnerability creates a pathway that bypasses those checks, allowing any installed program to read files belonging to separate applications.

Android’s security framework uses a different permission scheme and separate process isolation techniques, meaning the same exploit does not apply. Consequently, users of non-Apple smartphones are not exposed to this particular risk.

Because the bypass does not require a jailbreak, it works on standard, unmodified devices. The proof-of-concept code demonstrates that the exploit functions on devices running the affected iOS releases without additional hardware modifications.

Broader implications for crypto users and the exchange

The exchange at the center of the warning is the world’s largest platform for digital asset trading, founded in 2017. It processes billions of dollars in daily volume and serves tens of millions of customers worldwide.

Regulatory scrutiny has shaped the exchange’s recent history, including a settlement in 2023 that resulted in a multi-billion-dollar fine and leadership changes.