Binance warns iPhone users about iOS bug that could expose private keys

Binance has a message for crypto holders who keep their wallets on an iPhone: check your apps, and check them carefully.

On November 10, 2026, the exchange published a security advisory flagging a critical iOS vulnerability that could expose private keys, seed phrases and login credentials. The flaw lives in Apple’s operating system, not in Binance’s software. That distinction matters, because it means the risk extends well beyond one exchange’s customers.

What worse_query actually does

The vulnerability has been nicknamed worse_query. According to Binance’s advisory, it affects iOS versions 26.7.1, 27.0.1 and 27.2, covering both iPhones and iPads.

The problem is a breakdown in the walls between apps. iOS normally runs each app in its own sandbox, a sealed room that other apps cannot enter. Worse_query reportedly lets a malicious app slip through those walls and read local files belonging to other applications.

For crypto users, the contents of those other rooms are what matter. A wallet app may store sensitive data locally on the device. If a hostile app can read that data, it could potentially lift a seed phrase, the master recovery code that controls a wallet. Whoever holds the seed phrase effectively holds the funds.

Binance was explicit that the flaw sits at the iOS level. It is not specific to Binance’s apps or services, which means any app storing secrets on an affected device could, in theory, be exposed.

A short, messy timeline

The sequence of events moved quickly. Security researcher forcequitOS disclosed a proof of concept on November 8, 2026, crediting the discovery to another researcher identified as 0xjohnny.

Apple responded the following day. On November 9, 2026, it shipped iOS 27.2.1 and iOS 26.7.3. However, the official security notes for those updates did not explicitly confirm that worse_query had been fixed.

Binance’s advisory followed on November 10. The exchange said there were no confirmed incidents of attackers using the vulnerability to compromise crypto wallets as of that date.

The advisory was endorsed by Binance co-founder Yi He and by Charles Guillemet.

Binance’s advice to iPhone users

The exchange laid out a short list of steps for users worried about exposure:

Delete untrusted apps. The attack requires a malicious app on the device. Removing anything of questionable origin shrinks the opening.

Update through official channels. Binance urged users to install updates fully and only via Apple’s official process, rather than through third-party tools or links.

Consider a new wallet. If users have concerns that their device may have been compromised, Binance suggested creating a new wallet. The logic is simple: if an old seed phrase might have been read, moving funds to a wallet with a freshly generated phrase removes the stolen key’s value.

Not the first warning this year

This is not Binance’s first iOS-related alert in 2026. In September, the exchange issued an earlier advisory about a different malicious app that exploited iOS vulnerabilities.

For many crypto users, the phone has become the wallet. Exchange apps, self-custody wallets and authenticator apps often sit side by side on the same device. A flaw that lets one app peek into another turns that convenience into a concentration of risk.

What this means for crypto users and the industry

The immediate stakes fall on anyone holding self-custodied crypto on an affected iOS version. A seed phrase does not have server-side protections. If it leaks, there is no customer support line that can reverse the transfer.

Apple’s silence on the fix is the key variable. Until Apple’s security notes confirm worse_query is closed, users on 27.2.1 or 26.7.3 cannot be certain they are protected.

No confirmed wallet thefts have been linked to worse_query. But public proof-of-concept code tends to shorten the gap between theory and real attacks.