✓ Verified by 3+ outlets
Binance warns an iOS flaw could let malicious iPhone apps read wallet seed phrases
Summary
Binance warned Tuesday that a vulnerability affecting iOS 26.7.1, 27.0.1 and 27.2 could let a malicious app read local files from other apps, putting seed phrases, private keys and login credentials at risk, Decrypt and Cointelegraph reported.
The exchange called it "an iOS-level issue, not unique to Binance" and urged users to delete apps from untrusted sources, update iOS and all apps, and move funds to a new wallet on a clean device if they suspect a breach, according to both outlets.
Apple released iOS 27.2.1 on Monday, but neither outlet could confirm that it fixes this flaw: Decrypt said Apple's notes do not mention it, and Cointelegraph said Apple had not responded to its request for comment.
Both outlets said there are no confirmed reports of crypto being stolen through the bug; a Binance spokesperson told Cointelegraph it found no confirmed cases.
Updates
- Update, : Update (Nov. 10): Bitcoin Magazine also reported Binance's warning about the worse_query sandbox escape and said Apple's Nov. 9 updates do not mention the bug.
Key facts
- Decrypt: the flaw is dubbed "worse_query" and was published on GitHub by a researcher who goes by forcequitOS as a sandbox escape proof of concept; Decrypt describes it as covering iOS 26.0 through 26.7.2 and iOS 27.2.
- Cointelegraph: forcequitOS disclosed the flaw publicly on Sunday and credited another researcher who goes by 0xjohnny.
- Cointelegraph: SlowMist flagged the issue earlier Tuesday, saying a malicious app could read recovery phrases if a wallet stores them unencrypted on the device.
- Decrypt: SlowMist's chief information security officer, 23pds, urged users to update to iOS 27.2.1, saying it would block the worse_query sandbox escape.
- Cointelegraph: Apple released both iOS 27.2.1 and 26.7.3 on Monday; Decrypt said 27.2.1's notes list fixes for nine vulnerabilities, including an App Intents authorization issue.