Binance warns of an iOS flaw that could expose seed phrases
A malicious app could read other apps' data on iPhones running iOS 26 and 27. Apple released an update Monday, but its advisory does not mention the flaw.
Binance warned Tuesday about "worse_query," an iOS flaw that could let a malicious app read local files belonging to other apps, including seed phrases, private keys and login credentials for cryptocurrency wallets.
The flaw is not in Binance's app. A developer who goes by forcequitOS documented it in a public repository, where it is described as a sandbox escape (the isolation that keeps one app from accessing another's data) and as a proof of concept for developers that is not useful by itself.
The repository lists iOS 26.0 through 26.7.2 and iOS 27.2 as affected. No CVE has been assigned: neither the repository nor Apple's security advisory gives an identifier. Apple released iOS 27.2.1 and 26.7.3 on Monday. The advisory for the first lists nine fixes (AirPlay, App Intents, Bluetooth, brotli, CoreUtils, Messages and rapportd), and none describes a sandbox escape or names worse_query. Apple has not said whether those versions fix the flaw.
Binance recommends deleting apps installed outside trusted channels, updating iOS and all apps and, for anyone who suspects a breach, moving funds to a new wallet created on a clean device and signing out of open sessions. It adds that the problem is not exclusive to Binance.
Exploiting it requires a malicious app to be installed already. There are no confirmed reports of cryptocurrency stolen through the flaw, and no one has said whether an App Store app could take advantage of it. No specific wallets have been named as vulnerable.
Whoever holds a wallet's seed phrase, a string of words, controls its funds and can move them without the phone. That is why keeping one in an app, in notes or in screenshots depends on the isolation between apps holding up.
