Binance has issued a fresh security alert for Apple users, warning that a dangerous iOS vulnerability could expose cryptocurrency wallets, private keys, and sensitive login credentials. The flaw, identified as worse_query, reportedly allows malicious applications to circumvent Apple’s built-in restrictions and access files belonging to other apps. Binance has listed several affected software versions and advised users to uninstall applications obtained from untrusted sources.

The potential consequences go beyond cryptocurrency wallets. Applications that store confidential information directly on devices could also expose passwords, authentication data, and personal documents. This makes the vulnerability a broader concern for iPhone users who depend on their devices for banking, financial services, and crypto transactions.

The vulnerability reportedly targets Apple’s application sandbox, a security feature designed to keep applications separated and prevent unauthorized access to private files. Normally, an application cannot freely retrieve information stored within another app’s protected environment.

However, the worse_query exploit reportedly bypasses these safeguards, potentially giving malicious software access to directories containing information from other installed applications.

The public GitHub repository documenting the issue describes worse_query as a sandbox escape affecting iOS 26 and iOS 27. The reported affected versions include iOS 26.0 through 26.7.2, along with iOS 27.2.

Binance warns that sensitive information potentially exposed through the exploit includes cryptocurrency recovery phrases, private keys, and account passwords. If attackers obtain these credentials, they could potentially gain unauthorized access to users’ digital assets.

The level of risk varies depending on how individual applications store their data. Cryptocurrency wallets that retain recovery phrases or other sensitive credentials in locally accessible files may face greater exposure.

SlowMist’s security chief has also expressed concerns about the issue, highlighting how the exploit could challenge the security protections provided by Apple’s application isolation framework.

Apple’s Latest iOS Updates Leave Security Questions Unanswered

The availability of Apple’s latest software updates has created further uncertainty surrounding the vulnerability. According to Apple’s security release records, iOS 27.2 and iOS 26.7.2 were released on October 26, 2026.

However, the company’s published security advisories do not specifically identify worse_query. This means there is no publicly confirmed evidence that these updates fully resolve the reported sandbox escape.

A separate GitHub project associated with the exploit claimed on November 8 that Apple’s available software releases had not fixed the vulnerability. Consequently, users may not know whether installing the latest operating system provides complete protection against this particular security issue.

Binance recommends updating iPhones to the latest official iOS release and installing available application updates. It also advises removing software downloaded from unfamiliar sources, particularly manually signed IPA files.

For crypto investors, additional precautions may be necessary if a device is suspected of being compromised. Removing a suspicious application alone may not protect credentials that have already been accessed. Users should prioritize securing potentially exposed wallet information and account access.

Earlier iPhone Exploits Also Raised Crypto Security Concerns

The latest warning comes after several other incidents involving malicious iPhone applications and cryptocurrency-related data theft.

In September, Binance flagged FomoPeek, a third-party application whose versions 1.1 and 1.2 reportedly contained malicious code. Security researchers found that the software could exploit weaknesses in iOS to obtain elevated privileges on affected devices.

The information potentially exposed included cryptocurrency recovery phrases, private keys, login credentials, and other locally stored data.

More recently, CertiK highlighted the DarkSword exploit framework, which reportedly targeted cryptocurrency applications through compromised websites and vulnerable iPhones.

While these incidents involve different attack methods, they underline the growing security risks for investors who use smartphones to store and manage digital assets.

The latest Binance alert reinforces an important principle of cryptocurrency self-custody: protecting digital assets requires securing every location where sensitive wallet information is stored, rather than relying solely on the security of the wallet application.