Binance Warns iOS Flaw Could Expose Wallet Recovery Phrases

Binance has warned that a system-level flaw dubbed "worse_query" could let malicious iOS apps read wallet recovery phrases, private keys and login credentials stored by other applications. The exchange named iOS 26.7.1, 27.0.1 and 27.2 as affected releases in the advisory.

The flaw sits in Apple's operating system, not in Binance's own code. According to the warning, the issue can bypass iOS app isolation — the sandbox mechanism that normally prevents one application from opening files held by another. On the listed releases, a malicious app could potentially read local files belonging to other apps, including stored wallet credentials.

That distinction matters for operational risk. If the boundary weakens, any app on a compromised device becomes a potential reader of secrets held by wallet software, exchange apps and password managers alike, regardless of how carefully those apps store data.

What does Binance advise users to do?

The exchange's guidance covers both prevention and response:

• Remove apps installed from untrusted sources.
• Update iOS and all installed apps to the latest official versions.
• If a device is suspected to be compromised, move to a secure device, create a new wallet and transfer assets there.
• Reset all login sessions after any suspected compromise.

The recovery instruction effectively treats any compromised device as burned: keys and recovery phrases generated or stored on it should be abandoned rather than trusted again.

How broad is the exposure?

Binance framed the issue as an iOS-wide weakness affecting the three named releases rather than a defect confined to its platform. The advisory does not state how many devices run the affected versions, nor whether the flaw has been exploited in the wild. It also does not name the iOS releases that fix the issue, only directing users toward the latest official versions.

For custodial and self-custodial users alike, the advisory underscores a structural point: seed phrases and private keys stored in plaintext app sandboxes inherit the security of the underlying operating system. A sandbox bypass at the OS level defeats app-level protections without requiring a bug in the wallet software itself.

Apple has not publicly commented on the report as described in the advisory, and the flaw's formal classification — whether it will receive a CVE identifier or an Apple-published security note — remains open. Users running the affected iOS releases should expect a patch cycle from Apple, and until one ships, the practical mitigation is the one Binance laid out: trusted sources only, current software, and a clean-device wallet migration for anything suspected of exposure.