Binance warns of iOS sandbox flaw: iPhone users at risk as crypto wallet keys, passwords could be exposed
A publicly disclosed proof-of-concept has added to concerns around the vulnerability, while uncertainty over Apple’s latest security updates leaves iPhone users seeking clarity.
- Nov 11, 2026,
- Updated Nov 11, 2026 11:15 AM IST
iPhone users who store cryptocurrency wallets and other sensitive information on their devices have been urged to review their app security after Binance flagged a vulnerability in Apple’s iOS. The flaw could allow malicious applications to access files stored by other apps, potentially exposing information that is normally kept private. This includes cryptocurrency wallet recovery phrases, private keys and login credentials. The warning is particularly relevant for people who install applications from sources outside Apple’s App Store.
However, the concern extends beyond cryptocurrency platforms, as the vulnerability affects the way iOS separates data between applications. The issue has also drawn attention after a security researcher published a proof-of-concept demonstrating how the weakness could be used.
MUST READ | Samsung may bring paid Galaxy AI tools : These existing features will stay free
What is the iOS vulnerability flagged by Binance?
In a post on X on November 10, Binance identified the vulnerability as worse_query and named iOS 26.7.1, 27.0.1 and 27.2 as affected versions. The exchange said malicious apps could read local files belonging to other applications, putting seed phrases, private keys and login credentials at risk.
The vulnerability is described as a sandbox escape. Normally, Apple’s iOS sandbox restricts each app’s access to other applications’ private data. However, this flaw could allow an application to cross those security boundaries.
According to BleepingComputer, a researcher using the name forcequitOS published a proof-of-concept on GitHub. A tool called WQ Files demonstrates how the technique can be used to browse, export, edit and delete data belonging to other apps without requiring an iPhone jailbreak.
DON'T MISS | Apple Pay in India: HSBC in talks to join as second bank, other lenders explore tie-ups
Has Apple fixed the security flaw?
Apple released iOS 27.2.1 and iOS 26.7.3 on November 9, but its security notes do not explicitly mention worse_query. It is therefore unclear whether these updates address the vulnerability. Binance has advised users to install the latest official iOS and app updates.
The exchange has also recommended deleting apps from untrusted sources, including sideloaded applications and manually signed IPA files. If you suspect a breach, create a new wallet on a clean device, transfer your funds to it and reset all active login sessions.
There are no confirmed reports of cryptocurrency theft linked to this vulnerability so far, according to Binance’s comments to Cointelegraph. The warning, however, highlights the risks of installing applications from unverified sources.
For Unparalleled coverage of India's Businesses and Economy – Subscribe to Business Today Magazine
iPhone users who store cryptocurrency wallets and other sensitive information on their devices have been urged to review their app security after Binance flagged a vulnerability in Apple’s iOS. The flaw could allow malicious applications to access files stored by other apps, potentially exposing information that is normally kept private. This includes cryptocurrency wallet recovery phrases, private keys and login credentials. The warning is particularly relevant for people who install applications from sources outside Apple’s App Store.
However, the concern extends beyond cryptocurrency platforms, as the vulnerability affects the way iOS separates data between applications. The issue has also drawn attention after a security researcher published a proof-of-concept demonstrating how the weakness could be used.
MUST READ | Samsung may bring paid Galaxy AI tools : These existing features will stay free
What is the iOS vulnerability flagged by Binance?
In a post on X on November 10, Binance identified the vulnerability as worse_query and named iOS 26.7.1, 27.0.1 and 27.2 as affected versions. The exchange said malicious apps could read local files belonging to other applications, putting seed phrases, private keys and login credentials at risk.
The vulnerability is described as a sandbox escape. Normally, Apple’s iOS sandbox restricts each app’s access to other applications’ private data. However, this flaw could allow an application to cross those security boundaries.
According to BleepingComputer, a researcher using the name forcequitOS published a proof-of-concept on GitHub. A tool called WQ Files demonstrates how the technique can be used to browse, export, edit and delete data belonging to other apps without requiring an iPhone jailbreak.
DON'T MISS | Apple Pay in India: HSBC in talks to join as second bank, other lenders explore tie-ups
Has Apple fixed the security flaw?
Apple released iOS 27.2.1 and iOS 26.7.3 on November 9, but its security notes do not explicitly mention worse_query. It is therefore unclear whether these updates address the vulnerability. Binance has advised users to install the latest official iOS and app updates.
The exchange has also recommended deleting apps from untrusted sources, including sideloaded applications and manually signed IPA files. If you suspect a breach, create a new wallet on a clean device, transfer your funds to it and reset all active login sessions.
There are no confirmed reports of cryptocurrency theft linked to this vulnerability so far, according to Binance’s comments to Cointelegraph. The warning, however, highlights the risks of installing applications from unverified sources.
For Unparalleled coverage of India's Businesses and Economy – Subscribe to Business Today Magazine