Warning issued by Binance for iPhone users regarding iOS vulnerability exposing cryptocurrency wallet credentials

Binance Alerts iPhone Users to Critical iOS Vulnerability

Binance has issued a crucial alert for iPhone users regarding a substantial vulnerability in Apple's iOS, termed worse_query. This flaw permits unauthorized applications to read files from other apps, jeopardizing critical information like cryptocurrency wallet credentials. The security notice released on November 10 highlights that the affected iOS versions include 26.7.1, 27.0.1, and 27.2, signaling potential risks to sensitive data such as recovery phrases, private keys, and login credentials stored on the device. Importantly, this issue is rooted in Apple's operating system and not confined to Binance or any single application.

Understanding the Vulnerability

The root of the vulnerability lies within Apple's application sandbox—a security feature designed to safeguard apps from accessing each other's data without permission. Research on the worse_query indicates that it allows certain applications to bypass these restrictions and access directories normally off-limits, thus enabling what is known as a "sandbox escape."

The creators of the research have clarified that they view this exploitation as a proof of concept intended for developers, not a jailbreak.

While there is no evidence as yet linking this flaw to any cryptocurrency theft, it remains a severe risk for end users. Binance emphasized that any application storing sensitive information in areas exposed due to this vulnerability could be compromised.

Recommendations for Users

In its advisory, Binance also accentuated that this threat spans the entirety of the iOS ecosystem, not just cryptocurrency wallets, urging users to delete any applications sourced from untrustworthy outlets, particularly those that have been manually signed or sideloaded. They further recommended that users promptly update their devices and applications to the latest official releases.

For users who feel their wallet credentials may have been compromised, Binance suggests creating a new wallet on an entirely clean device, transferring their assets, and resetting login sessions to ensure security. The alert has drawn attention online, with X user DUKE reiterating the importance of removing any untrusted applications.

Previous Incidents and Ongoing Threats

The warning comes on the heels of previous incidents where malicious iPhone apps were found to compromise user security by accessing cryptocurrency details. Previous reports in September revealed similar threats from the FomoPeek applications, which contained malicious code capable of unauthorized data access. A security investigation by SlowMist uncovered various exploit methods employed by these applications to gain elevated access to Apple devices, exposing sensitive account information and recovery phrases.

In response to these ongoing threats, Apple has issued multiple security updates aimed at fixing the vulnerabilities affecting the flagged iOS versions. Notably, iOS 27.2 was released on October 26, 2023, followed by iOS 27.2.1 just days later on November 9, which included fixes for several security issues. However, it is important to note that Apple has not specifically referenced worse_query in their advisories, nor has a CVE number been assigned to this particular sandbox escape, leaving some uncertainty regarding whether recent updates fully mitigate the risks posed by this vulnerability.

Emerging Threats and User Vigilance

Further complicating matters, a separate vulnerability, CVE-2026-86950, related to CoreGraphics and potential exploitation, was patched in September, but it has not been conclusively linked to the worse_query flaw. In more recent developments, CertiK reported that a revamped exploit framework known as DarkSword could target cryptocurrency apps on susceptible iPhones, possibly endangering users of well-known wallets like MetaMask, Trust Wallet, Phantom, Exodus, and Coinbase, particularly when users inadvertently visit malicious websites using Safari.

While the landscape of security for Apple devices continues to evolve amid these threats, Binance, along with other cryptocurrency security researchers, urges users to maintain vigilant practices, including the avoidance of unverified applications and frequent updates of both devices and app software. Binance's request to respond for further comments had not received a reply at the time of this reporting.