Binance Warns of iOS Vulnerability That Could Expose Private Keys

Binance has issued a warning to iPhone users regarding a security vulnerability in Apple's iOS ecosystem that could potentially expose sensitive information. The exchange noted that malicious applications might be able to read files stored by other apps, which could put crypto wallet seed phrases, private keys, and login credentials at risk. While many users rely on the Binance app for their daily trading, the exchange emphasized that this is a system-level issue affecting the iOS platform rather than a problem specific to their software.

Understanding the Binance security alert

The vulnerability, identified as "worse_query," reportedly affects iOS versions 26.7.1, 27.0.1, and 27.2. Under normal conditions, iPhone applications operate within a sandbox environment designed to prevent them from accessing the private data of other installed apps. However, a researcher using the handle forcequitOS published the proof of concept on GitHub, describing it as a sandbox escape that can reach folders where apps store their data. The researcher noted that the exploit is a successor to an earlier issue known as bad_query.

Binance has advised users to take immediate precautions to protect their assets. The exchange recommends that users remove any applications installed from untrusted sources, particularly those that have been sideloaded or manually signed. Furthermore, users are encouraged to update their iOS and all installed applications to the latest official versions. For those who suspect their security may have been compromised, the exchange suggests moving funds to a new wallet created on a clean device and resetting all active login sessions.

Apple released iOS 27.2.1 on Monday, shortly after the proof of concept was made public. While the company's security documentation lists fixes for nine vulnerabilities—including an authorization issue in App Intents that could allow unauthorized access to sensitive data—it does not explicitly mention "worse_query." Despite this, some security experts, including 23pds from the blockchain security firm SlowMist, have urged users to apply the update, suggesting it likely addresses the sandbox escape alongside other threats. There have been no confirmed reports of cryptocurrency being stolen as a result of this specific flaw.

A reported iOS vulnerability could allow malicious apps to access sensitive data like private keys and passwords.

Why it matters

The discovery of the "worse_query" flaw highlights the ongoing security challenges facing mobile device users, particularly those managing digital assets. Because Apple has not publicly confirmed whether the latest update addresses this specific vulnerability, the situation remains a point of concern for the broader crypto community.

This issue underscores the importance of maintaining updated software and avoiding the installation of apps from unverified sources. For users globally, including those monitoring the security of their digital holdings, the incident serves as a reminder to prioritize device hygiene and follow recommended security protocols to mitigate risks of unauthorized data access.