Osegi
Security·1 min read

worse_query iPhone flaw: Binance warns crypto holders, no fix yet

Binance says a bug called worse_query lets rogue iPhone apps read other apps' files, including seed phrases. Researchers say iOS 27.2.1 doesn't fix it.

An iPhone showing a crypto wallet app with a red security warning icon over the screen.
Image: 9to5Mac
SUMODialoediviewergiftdetect

Binance has told iPhone owners that a flaw called worse_query could let a malicious app read files belonging to other apps, including crypto seed phrases, private keys and saved logins. Researchers say Apple hasn't fixed it yet.

In a post on X, the exchange said the bug affects iOS 26.7.1, iOS 27.0.1 and iOS 27.2. It also stressed that this is an iOS-level problem, not something specific to Binance. A Community Note on the post points out that Apple's latest updates, including iOS 27.2.1, don't mention a fix.

The researcher @forcequitOS says the same: worse_query is not patched in iOS 27.2.1 or in the first iOS 27.3 beta.

What is worse_query?

It's a vulnerability found by researchers @0xjohnny and @forcequitOS. They published a proof of concept on GitHub showing how it gets around the iOS sandbox, the wall that normally stops one app from touching another app's files.

The researcher describes the code as meant for developers and not much use on its own. Still, other developers have already built apps with it, including a file manager that can read, change and delete other apps' data without a jailbreak.

What should iPhone crypto holders do?

Binance recommends three things:

  • Delete apps installed from untrusted sources, such as sideloaded or manually signed IPAs.
  • Update iOS and all apps to the latest official versions.
  • If you suspect a breach, move your funds to a new wallet created on a clean device and reset all active login sessions.

Neither Binance nor the researchers have reported any attacks or thefts using the flaw so far. But with no patch in sight, the advice about untrusted apps is the part worth acting on today.

Apps worth a look

SUMO: the number puzzle

Tap the right tiles, add them up, hit the target. Easy to learn, hard to master. Free, for all ages.

Tags:binanceiosworse_queryzero-dayiphone securitycrypto wallets

More from this day

See all →

More in: Security

See all →