Binance warns an iOS flaw lets malicious apps read wallet seed phrases on iPhones
Binance tells iPhone users to delete sideloaded apps and update iOS. It calls the flaw, named worse_query, an iOS-level issue that is not unique to Binance. Apple has not listed a fix, and no thefts have been reported.
· Announced · Verified 2026-11-11 via official announcement
Announced Nov 10, 2026: Binance warns an iOS flaw lets malicious apps read wallet seed phrases on iPhones. Affects: iPhone users who keep exchange logins or self-custody wallet keys on the device. Source: x.com, verified Nov 11, 2026. If this rules Binance out, our top-listed alternative is Bybit (0.2% round trip; code WQ3GV, $20 sign-up bonus).
Binance warned on 10 November 2026 that a vulnerability called worse_query, affecting iOS 26.7.1, 27.0.1 and 27.2, lets malicious apps read local files from other apps, putting seed phrases, private keys and login credentials at risk. It said the problem is at the iOS level and affects the whole ecosystem, not only Binance. Binance told users to delete apps installed from untrusted sources and update iOS and all apps.
Binance's advice: remove sideloaded or manually signed apps, update iOS and every app to the latest official versions, and if a breach is suspected, move funds to a new wallet created on a clean device and reset all active login sessions.
A researcher who posts as forcequit published worse_query on GitHub on 8 November as a sandbox escape that can reach other apps' data. The Hacker News reports the researcher gives a wider range of affected versions than Binance lists, and that one tool built on it installs through sideloading services such as AltStore and SideStore. No one involved has said whether an App Store app could use it.
Apple released iOS 27.2.1 on 9 November. Its security notes do not mention worse_query or a sandbox issue, so a fix is not confirmed. Neither Binance nor the researcher has reported any thefts using the flaw. Risk depends on a user having installed a malicious app and on how each wallet app stores its secrets on the device.
“This is an iOS-level issue, not unique to Binance.”
— Binance on X
Who this affects
iPhone users who keep exchange logins or self-custody wallet keys on the device, especially those who have installed sideloaded or manually signed apps.
Binance at a glance
Binance is a centralised crypto exchange founded in 2017 by Changpeng Zhao, now run under Abu Dhabi (ADGM) entities regulated by the FSRA. It offers spot, margin, futures, options, earn products and P2P. Regular users pay 0.10% spot maker and taker (0.075% when paying fees in BNB) and 0.02%/0.05% on USDT-margined futures. It does not serve the US, Canada or the Netherlands; Binance.US is a separate company.
Full Binance sheet · 0.2% round trip · Also affects Binance Wallet
Official site: binance.com
More from the newsroom
Sources
Last checked . Fees and terms change often; the venue's own page wins if it disagrees with ours.
- Binance on X - worse_query vulnerability affecting iOS 26.7.1, 27.0.1 and 27.2 (2026-11-10) — checked 2026-11-11
- The Hacker News - Binance Warns of iOS Sandbox Escape That Could Expose Crypto Wallet Keys, No Fix Confirmed (2026-11-10) — checked 2026-11-11
- Apple - About the security content of iOS 27.2.1 and iPadOS 27.2.1 (released 2026-11-09) — checked 2026-11-11
- forcequitOS/worse_query on GitHub — checked 2026-11-11
- Decrypt - Binance Warns of Apple iOS Flaw That Could Expose iPhone Users' Private Keys — checked 2026-11-11
About DexSheet
DexSheet is an independent fee sheet for on-chain trading. It tracks the fees, custody, backers, incidents and availability of 98 crypto trading venues, with a dated source for every number. Every newsroom entry is checked against the venue's own announcement, docs or terms before it is published. Data: fees.json (CC BY 4.0) · RSS.