iPhone worse_query bug: Binance warns crypto wallets are at risk
Binance says an unpatched iOS flaw called worse_query lets a malicious app read files from other apps, including wallet seed phrases and private keys.
SUMO· the number puzzle
Dialo· learn languages by speaking
ediviewer· read EDI files like documents
giftdetect· the right gift in minutesBinance has told iPhone owners to be careful: an unpatched iOS flaw called worse_query could let a malicious app read files that belong to other apps, including crypto wallets.
According to the exchange, the bug can expose seed phrases (the recovery words for a wallet), private keys and saved logins. It says the problem sits in the operating system itself, so it isn't limited to Binance or to crypto apps. Binance lists iOS 26.7.1, iOS 27.0.1 and iOS 27.2 as affected.
Security researchers say Apple hasn't fixed it yet. The latest stable release at the time of reporting, iOS 27.2.1, doesn't include a patch, and neither does the first beta of iOS 27.3.
How does the worse_query flaw work?
Normally iOS keeps apps apart with a sandbox, a barrier that stops one app from touching another app's data without permission. This bug can get around that barrier.
Two well-known security researchers disclosed it and put a proof-of-concept on GitHub. That code was written for developers and isn't a threat on its own. But other developers have already built apps that use it, including a file manager that can read, edit and delete other apps' data without a jailbreak.
What should iPhone users do?
Binance's advice is practical. Delete any app you installed from an untrusted source, such as files sideloaded by hand outside the App Store. Update iOS and all your apps to the latest official versions.
If you think your phone is compromised, move your funds to a new wallet created on a clean device, then sign out of all active login sessions and reset them.
There is some good news. Neither Binance nor the researchers have reported confirmed attacks or crypto thefts linked to the flaw so far.
Apps worth a look
SUMO: the number puzzleTap the right tiles, add them up, hit the target. Easy to learn, hard to master. Free, for all ages.
Dialo: learn languages by speakingTalk to an AI conversation partner; every sentence comes back corrected and explained in your language. 9 languages, A1 to C2.
ediviewer: read EDI files like documentsOpen EDIFACT and X12 messages, see every segment explained, convert to JSON/XML, export PDF and Excel. Runs locally, no upload.
giftdetect: the right gift in minutesPick who it is for, the occasion and their personality. The search engine reads product descriptions from local shops and ranks what fits. Free, no sign-up.
More from this day
See all →
Meta Muse can now phone businesses for you in the US
AgiBot G2 robots run a Shanghai store for 24 hours, 1,730 tasks
Microsoft outage: Outlook, Teams and Office down for 11 hours
Anduril-216 satellite spots other satellites in Earth's shadow
More in: Security
See all →
Cyber Security Cloud GitHub leak: one stolen login exposed customer data
wfx-loot attack hit 61,000 GitHub repos to steal secrets
SignDrop Windows zero-day turns Defender against itself
