Binance warns iPhone users about the "worse_query" iOS flaw: what it means for your crypto wallet

Your iPhone keeps each app in its own locked room, so a game can't peek at your banking or wallet app. A newly published flaw called worse_query breaks that wall. On November 10, 2026, Binance and the security firm SlowMist warned crypto users that a malicious app using it could read wallet secrets that other apps leave lying around in plain files. Here's who's at risk and the three things to do.

What happened

• November 8: a researcher who goes by forcequitOS published worse_query on GitHub, together with a collaborator, @0xjohnny. The project page calls it a sandbox escape for iOS 26.0 to 26.7.2 and iOS 27.2, describes it as a proof of concept for developers, and says plainly that it is not a jailbreak. It is the follow-up to an earlier escape by the same researcher called bad_query.
• November 10, about 1:46 AM ET: SlowMist posted an alert. Its key point: the bug doesn't take anyone's crypto on its own. The risk starts when someone puts an app on their phone from outside a trusted store, such as a sideloaded IPA file, and a wallet on that phone keeps its seed phrase, keystore or in-app web page cache in plain text.
• November 10, about 4:56 AM ET: Binance posted its own warning, saying the flaw puts "seed phrases, private keys, and login credentials at risk across the entire ecosystem" and that it is "an iOS-level issue, not unique to Binance." Its warning names iOS 26.7.1, 27.0.1 and 27.2.

Neither Binance nor SlowMist reported any crypto stolen through this flaw. crypto.news, which covered Binance's warning, noted that the published material doesn't show it has been used to take funds.

What a "sandbox escape" means, in plain words

On an iPhone, every app runs in a sandbox: its own private folder that other apps can't open. That's a big reason iPhones are hard to infect. worse_query is code that lets an app reach outside its own folder into folders that belong to other apps and parts of the system.

That only matters if a harmful app gets onto your phone in the first place, and if the app you care about stores something valuable in a readable file. A well-built wallet keeps secrets locked in the phone's protected keychain or encrypted storage. SlowMist's advice to wallet makers is simply not to store sensitive data in plaintext locally, which tells you the worry is wallets that cut that corner.

Is there a fix yet?

Not a confirmed one. Apple shipped iOS 27.2.1 and iOS 26.7.3 on November 9, 2026, the day after worse_query went public. Apple's security notes for those releases list several fixes, but none of them mentions worse_query by name. Apple's policy is to stay silent about a security problem until it has looked into it and released a fix, so we can't tell yet whether these updates close it. One early sign isn't good: the makers of Erosion, a hobby iPhone customization tool built on worse_query, now list iOS 27.2.1 as supported, though their own note on that change says only that they're \"pretty sure.\" Installing the update is still the right move, but don't assume it protects you from this flaw. For now, avoiding untrusted apps is what protects you.

What to do now

• Delete apps that didn't come from the App Store. Binance's first step is to remove anything sideloaded or manually signed. If you don't know what that means, you almost certainly haven't done it.
• Update iOS and every app. Go to Settings, then General, then Software Update. Then open the App Store and update your apps, especially your wallet.
• If you did install an untrusted app on a phone that holds a wallet, treat that wallet as exposed. Set up a fresh wallet on a phone or computer you trust, write its new seed phrase on paper, move your funds over, sign out of all active sessions on your exchange accounts, and change the passwords for any accounts you used on that phone.
• Never keep your seed phrase in your phone. Not in Notes, Photos, a screenshot or a text file. Our seed phrase guide shows safer ways to store it.
• For savings, consider a hardware wallet. Its keys stay on the device, out of reach of phone apps. See can hardware wallets be hacked? for its limits.
• Ignore "security check" offers. Scammers follow headlines like this with fake apps, texts and DMs that promise to scan your wallet. A real fix comes only from Apple's Software Update and the App Store. Unsure about a message? Run it through our Scam Check.

The takeaway

worse_query is a real, public iPhone flaw, but it needs a malicious app on your phone to do harm, and we found no reports of thefts from it so far. Stick to the App Store, keep iOS updated, and keep your seed phrase off your phone. This is education, not financial advice, and it reflects company and researcher statements as of the morning of November 10, 2026.

Published November 10, 2026 by Dave McNaught. Educational content, not financial, legal or tax advice. Spot an error? Request a correction.

About the author

Dave McNaught

Dave McNaught has worked in IT since 1999 and founded All Business Technologies (ABT) in 2003, a Boston-area firm providing Managed IT, Cybersecurity, Managed AI, Web Design and App Development. He publishes The Crypto Guide.

Full bio