Binance has warned iPhone users about worse_query, an iOS flaw that could let malicious apps read files belonging to other apps. In its November 10 warning, the exchange named iOS 26.7.1, 27.0.1, and 27.2 as affected, saying seed phrases, private keys, and login details could be exposed. The company said this is an operating system issue, not a flaw unique to Binance. The warning concerns the boundary that normally keeps each app’s private files separate. If an attacker crosses that boundary, sensitive data stored by wallets and other apps could become accessible. A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.… — Binance (@binance) November 10, 2026 iOS crypto wallet vulnerability Researcher forcequitOS published worse_query as a developer proof of concept. Its documentation describes a sandbox escape for iOS 26.0 through 26.7.2 and iOS 27.2. A sandbox is the restricted space that limits what an app can access, including files held by other apps. The project lists access to application data folders, shared App Group folders, and some system locations. It requires an App Group container, a shared storage area linked to an app. The researcher calls it a proof of concept that “isn’t useful by itself,” rather than a complete theft tool. Cybersecurity News previously covered iOS sandbox escape fixes that addressed similar failures in app isolation. However, those earlier patches do not establish that worse_query is fixed. For this flaw, the key concern is whether another app’s readable files contain secrets that should remain protected. The worse_query research repository documents file access, not confirmed cryptocurrency theft. SlowMist security chief 23pds separately warned that untrusted IPA packages could use this access to expose wallet recovery phrases, keystores, or browser cache data stored without encryption. The flaw does not automatically drain wallets. That distinction matters. Access to a wallet’s files does not necessarily reveal usable private keys. Risk depends on what the wallet saves and how it protects those records. Related SparkKitty malware coverage shows another exposure route, where attackers searched phone images for recovery phrases rather than breaking app isolation. Binance recommends deleting apps from untrusted sources, including sideloaded or manually signed IPA files, and updating iOS and installed apps. Anyone who suspects a breach should move funds to a new wallet created on a clean device and reset active login sessions. Apple’s security release page lists iOS 27.2.1 and iOS 26.7.3 updates released November 9. However, that listing alone does not confirm a worse_query fix. Users should install official updates without treating an update as proof that previously exposed wallet secrets are safe. Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs . The post Binance Warns iPhone Users of Major iOS Flaw That May Expose Crypto Wallet, Private Keys appeared first on Cyber Security News .