Binance Warns iPhone Users as Sandbox Bug Exposes Seed Phrases and Private Keys

TLDR

Binance warned iPhone users about an iOS flaw called worse_query.
The bug can let harmful apps read files stored by other apps.
Researchers say iOS 27.2.1 and the iOS 27.3 beta do not fix it.
Developers have already built a file manager using the flaw, no jailbreak needed.
No attacks or crypto thefts tied to the bug have been reported so far.

A security flaw in Apple’s iPhone software may let harmful apps read files stored by other apps, according to researchers who say the issue has not been fixed. Crypto exchange Binance has warned users that the bug could expose wallet seed phrases and private keys.
The flaw, called worse_query, was not addressed in Apple’s latest public update, iOS 27.2.1. One of the researchers behind the discovery says the first beta of iOS 27.3 does not fix it either.
Binance shared the warning in a post on X on November 11. The exchange said the bug puts seed phrases, private keys and login credentials at risk across the entire iPhone ecosystem.

A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.…
— Binance (@binance) November 10, 2026

Seed phrases and private keys control access to crypto wallets. Anyone who obtains them can move the funds held in those wallets.
What the Researchers Found
The vulnerability was disclosed by security researchers known online as @0xjohnny and @forcequitOS. They published a proof of concept on GitHub showing how the flaw can bypass iOS sandbox protections.
The sandbox is a core security feature on the iPhone. It normally keeps each app walled off, so one app cannot open or read another app’s files.
@forcequitOS said the published code is meant for developers and is not useful on its own. Even so, other developers have already used it to build working apps.

Just as a general statement so there isn’t any confusion about it, worse_query is *not* patched in iOS 27.2.1 and 27.3 beta 1. I’ll update version support on the readme when it’s patched.
— forcequit (@forcequitOS) November 10, 2026

One of those apps is a file manager that can access, change and delete data belonging to other apps. It works without a jailbreak, which is the process of removing Apple’s software limits on a device.
Binance said the flaw affects iOS 26.7.1, iOS 27.0.1 and iOS 27.2. A Community Note added to the post said researchers describe the bug as an unpatched zero-day, meaning a flaw with no fix available yet.
Apple’s list of recent security updates, including the one for iOS 27.2.1, does not mention a fix for the issue. iOS 27.2.1 was the newest public version when the warning was reported.
Binance Lists Steps for Users
Binance told iPhone users who hold crypto to act right away. Its first step is to delete any apps installed from untrusted sources.
That includes sideloaded apps and manually signed IPA files. IPA is the file format used for iPhone apps.
The exchange also told users to update iOS and all apps to the latest official versions. Researchers say current versions of iOS still carry this specific flaw.
Users who think their device has been breached should move their funds to a new wallet. Binance said that wallet should be created on a clean device.
The exchange also advised resetting all active login sessions. This step can cut off access for anyone who may have taken account details.
According to The Hacker News, neither Binance nor the researchers have reported any attacks linked to the flaw. No cryptocurrency thefts tied to worse_query have been reported so far.
The post Binance Warns iPhone Users as Sandbox Bug Exposes Seed Phrases and Private Keys appeared first on Blockonomi.