Binance on Tuesday warned iPhone users that a vulnerability called worse_query “allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem.”
Binance listed iOS 26.7.1, 27.0.1 and 27.2 as affected, adding that “this is an iOS-level issue, not unique to Binance.” Co-founder Yi He reposted the warning about an hour and a half later with the same instructions.
Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.
What Binance Told Users to Do
Binance’s first step was to remove any app that came from an untrusted source, “such as sideloaded or manually signed IPAs,” meaning iOS App Store Package (IPA) files loaded from outside the App Store. It also told users to bring iOS and every app up to the newest official release. Users who suspect a breach should move their funds to a new wallet on a different, clean device and sign out of all sessions, the exchange said.
The Exploit Code
The bug traces to a public proof-of-concept posted on GitHub by a developer who goes by forcequitOS. The repository describes it as a sandbox escape, code that breaks out of the walled-off storage iOS gives each app, for iOS 26.0 through 26.7.2 and 27.2. That range includes two of the builds Binance named but does not list 27.0.1.
The developer wrote that the code “isn’t useful by itself,” and the repo says it requires an App Group container, the shared storage Apple lets one developer’s related apps use. The developer presents it as a replacement for bad_query, an earlier exploit. The page shows no publication date.
Apple shipped iOS 27.2.1 on Nov. 9. Its security notes for that release list nine fixes, and none names worse_query.
Binance’s warning arrives less than two weeks after the exchange’s hot wallets were drained for about $6.3 billion.
Related Listen: Is an iPhone a Better Hardware Wallet Than a Ledger? – Uneasy Money
