Two weeks after losing more than $6 billion in the largest crypto hack ever recorded, Binance has a new warning, and this one is about your phone. As UNILAD Tech reported, the exchange is telling iPhone users on iOS 26 and iOS 27 to delete any app that didn’t come from Apple’s official App Store.
The reason is a publicly released iOS bug nicknamed worse_query, which can let one app peek into another app’s files. Binance says it isn’t a Binance problem, it’s an iPhone problem. That sounds scary, and for some people it is. For most iPhone owners, though, the real risk depends on a few specific conditions. Here’s what the bug does, who should worry, and what to check right now.
The short version
- Binance posted the warning on X on November 10, naming iOS 26.7.1, 27.0.1 and 27.2.
- worse_query is a sandbox escape, not a jailbreak. A malicious app could read other apps’ local files, including seed phrases or keys stored unencrypted.
- The known proof of concept installs through sideloading tools like AltStore and SideStore, not the App Store.
- No confirmed thefts so far, according to Binance.
- Apple has not confirmed a fix. iOS 27.2.1’s notes don’t mention it, and reports on whether it’s patched conflict.
What Binance actually said
Binance’s post called it “an iOS-level issue, not unique to Binance.” The exchange said the flaw allows “malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem.” Its advice was simple: delete apps from untrusted sources, meaning anything sideloaded or manually signed, and keep iOS and all your apps updated.
Binance co-CEO Yi He shared the warning shortly after with one more piece of advice: “If you suspect a breach, transfer funds to a new wallet created on a clean device and reset all active login sessions.”
Binance also told Cointelegraph there have been no confirmed losses linked to the bug. The warning is preventive, but given what happened to Binance last month, it isn’t surprising the company is being loud about it. We broke down that attack in detail, including how a single engineer’s laptop led to the $6.3 billion heist.
What is worse_query?
Every iPhone app lives in its own sandbox. That’s Apple’s core security idea: your banking app can’t see your photos app’s files, and a random game can’t read your wallet. worse_query breaks that wall in a specific way.
A researcher who goes by “forcequit” published a working proof of concept on GitHub on November 8. It’s a follow-up to an earlier exploit called bad_query. The researcher said they went public because “Apple was stalling on responding to me.” No CVE number has been assigned in any public report so far.
What has to be true for you to be at risk
1. A BAD APP IS INSTALLED
A malicious app has to actually run on your iPhone. The known demo arrives by sideloading.
2. IT USES AN APP GROUP
According to security firm SlowMist, the app needs to set up an App Group container to pull off the escape.
3. YOUR WALLET STORES KEYS IN PLAIN FILES
The target app has to keep its seed phrase or keystore unencrypted in its own folder.
That third point is important. According to SlowMist, there’s no evidence the bug defeats the iPhone’s Keychain or the Secure Enclave, the hardware vault Apple uses for the most sensitive secrets. Well-built wallet apps keep keys there. No specific wallet app has been publicly shown to leak keys through this bug.
Which iOS versions are affected?
This is where things get a little messy. Binance and the researcher list different ranges, and nobody outside Apple has a definitive answer.
| iOS version | Status | Source |
|---|---|---|
| iOS 26.0 to 26.7.2 | Vulnerable | Researcher (Binance named 26.7.1) |
| iOS 27.0.1 | Vulnerable | Binance |
| iOS 27.2 | Vulnerable | Binance and researcher |
| iOS 26.7.3 and 27.2.1 | Unclear | Released Nov 9. Release notes don’t mention it. Reports conflict. |
| iOS 27.3 beta 1 | Reportedly still vulnerable | Researcher reports, unconfirmed |
Apple shipped iOS 27.2.1 and iOS 26.7.3 on November 9 with nine security fixes, covering AirPlay, Bluetooth, Messages and App Intents among others. None of the notes mention a sandbox escape. Some reports say SlowMist found 27.2.1 blocks the exploit, while others say researchers still see 27.2.1 and the first iOS 27.3 beta as vulnerable. Apple hasn’t commented publicly. Updating is still the right move, because 27.2.1 fixes other real problems either way.
Why crypto users are the obvious target
A bug that reads other apps’ files is bad for anyone. It’s worse for crypto, because a seed phrase is the whole wallet. There’s no bank to call and no chargeback. If someone copies those 12 or 24 words, the money is gone.
Crypto stolen by hackers in 2025
Billions of US dollars, per Chainalysis
Total stolen $3.4B+
Stolen by North Korean groups $2.02B
Bybit hack alone $1.5B
Losses from personal wallets $713M
For comparison, the October 29, 2026 Binance hack alone came to about $6.36B, according to TRM Labs.
Personal wallet losses actually fell in 2025, down from about $1.5 billion the year before, but they were spread across roughly 158,000 incidents and at least 80,000 victims. That’s the category a phone bug like this would feed. Big exchange hacks grab the headlines. Small, individual drains are where regular people get hurt.
Seven things to do on your iPhone right now
None of this takes long. If you hold any crypto on your phone, it’s worth five minutes today.
Your quick security checklist
- Check your iOS version. Go to
Settings > General > About. Then update inSettings > General > Software Update. - Look for developer profiles. Open
Settings > General > VPN & Device Management. Remove any profile or developer certificate you don’t recognize. - Remove sideloading tools. Delete AltStore, SideStore and any apps you installed through them or other signing services.
- Review TestFlight betas. Beta apps show an orange dot next to their name. Open TestFlight and remove anything you don’t need.
- In the EU? Review apps from alternative app marketplaces and delete the ones you don’t fully trust.
- Never store a seed phrase digitally. No notes, no screenshots, no files. For large amounts, use a hardware wallet.
- If you think you’re compromised, create a new wallet on a clean device, move your funds, log out of every exchange session, and change passwords and 2FA.
Can an App Store app use this?
In theory, yes. The researcher says an App Store app could include the exploit, but it would have to get past Apple’s App Review first. No malicious App Store app using worse_query has been found. That’s why Binance focused its warning on apps from outside the store.
The bigger picture for iPhone security
The iPhone’s reputation rests on the idea that apps can’t spy on each other. Bugs like this don’t break that promise for most people, but they show how much depends on users staying inside Apple’s walls. Sideloading has grown more common, especially in the EU, and tools like AltStore have made it easy. That convenience comes with exactly this kind of risk. Older devices are a separate concern too, as we found when Gen Z started buying iPhone 5Cs that haven’t had a security update since 2017.
The takeaway
If every app on your iPhone came from the App Store, your risk from worse_query is low. If you sideload, use TestFlight betas you don’t remember installing, or keep a seed phrase in a note, act today. Update iOS, delete what you don’t trust, and move serious crypto holdings to a hardware wallet. Then watch for Apple’s next security update, because until it confirms a fix, nobody can say this is fully closed.
About this article: GeekBlog covers U.S. technology news, AI, phones, smartwatches and gaming. Every story is written and checked under our Editorial Policy. Spotted a mistake or have a story tip? Contact our editors.
