An iOS bug disclosed this week lets a malicious app reach files that belong to other apps, exposing seed phrases, login data and the keys behind crypto wallets, Binance said in a post on X on Nov. 10.
The bug, named worse_query, is a sandbox escape, not a jailbreak, according to its creator: an app reaches into a shared App Group container to pull data meant for another app. It succeeds an earlier flaw called bad_query. A researcher going by forcequitOS put the exploit code up on GitHub on Sunday, Nov. 8.
The bug reaches iOS versions 26.7.1, 27.0.1 and 27.2, Binance said. Blockchain security researchers at SlowMist raised the same alarm. Binance said the flaw sits inside iOS itself, separate from its own app.
A company spokesperson said: “The underlying file-access risk may apply across the iOS ecosystem.” No theft of cryptocurrency through worse_query had been confirmed as of the warning.
Binance told users to remove any app they did not get from an official store and bring iOS and every app up to date. Anyone who suspects a device was already compromised should shift their funds to a fresh wallet on a clean device, the exchange said.
Apple shipped iOS 27.2.1 and iOS 26.7.3 on Monday, Nov. 9, a day after the proof of concept went public. Its release notes make no mention of worse_query and do not confirm the update closes the hole.
