Binance warns of iOS vulnerability exposing crypto wallets

A critical security gap identified as Worse_Query has prompted Binance to issue a warning regarding potential cryptocurrency theft. The exchange highlighted on November 10th that this vulnerability impacts iOS versions 26.7.1, 27.0.1, and 27.2.

Mechanics of the Security Flaw

The standard iOS operating system employs an application isolation mechanism known as a sandbox, which restricts unauthorized access between different applications' data. However, Worse_Query bypasses certain protections within this framework. Researchers have released test code proving the exploit's viability and developed a tool called WQ Files. This utility enables users to access, copy, edit, and delete data from other applications without requiring a jailbroken device.

Risks to Digital Assets

For holders of digital currencies, the primary concern involves the exposure of sensitive credentials such as wallet recovery phrases, private keys, or login information. If malicious actors obtain these recovery phrases, they can restore the wallet on a separate device and transfer assets without the owner's consent. Binance clarified that this defect resides at the Apple operating system level rather than being specific to the exchange's own application.

Patch Status and Recommendations

Apple issued updates for iOS 27.2.1 and 26.7.3 on November 9th to address various security vulnerabilities. Despite these releases, official announcements have not clearly confirmed how Worse_Query was remediated. Some researchers indicate the vulnerability persists post-update, though no confirmed reports exist of cryptocurrency assets being stolen via this specific flaw. The extent of the risk varies depending on how individual applications store and protect their data.

Binance advises users to remove unnecessary applications or those installed from unreliable sources. It is also recommended to update both iOS and all apps to the latest official versions. In cases where a device is suspected of compromise, users should transfer assets to a newly created wallet on a secure device and re-establish any active login sessions.