Binance issued a security advisory on November 10, 2026, warning iPhone users about an iOS vulnerability known as “worse_query.” The flaw, which affects versions including 26.7.1, 27.0.1, and 27.2, could allow a malicious application to read local files belonging to other apps. This raises the risk of exposing sensitive data such as cryptocurrency seed phrases, private keys, and login credentials if those items are stored in accessible files.
Binance stressed that the issue is at the operating-system level and is not unique to its own applications or wallets. The warning was amplified by company executives and security observers, including references to research from firms such as SlowMist and public disclosures by researchers. Apple released iOS updates (including 27.2.1 and 26.7.3) around the same period, but it remains unclear whether those patches fully resolve the reported technique. Binance has not reported confirmed cases of crypto theft linked to the vulnerability.
The Drivers of the Current Situation
The main development is Binance’s public alert highlighting a potential cross-app file-access weakness on certain iOS versions that could compromise locally stored wallet secrets. Confirmed elements include the November 10 advisory, the named affected iOS builds, the description of malicious apps reading other apps’ local files, the explicit statement that the problem is OS-level rather than app-specific, recommendations to remove untrusted or sideloaded apps and update software, and the advice to generate new wallets on clean devices if compromise is suspected. Related factors include the dependence of mobile wallet security on app sandbox isolation and the varying storage practices of different wallet applications.
Further confirmation of patch status from Apple or additional technical analysis will clarify residual risk.
Impact and Broader Context
The warning underscores ongoing challenges in mobile operating-system isolation for users who store high-value cryptographic secrets on smartphones. It raises questions about the reliability of app sandboxing against sophisticated local-file access techniques, the prevalence of sideloaded or untrusted apps as an attack vector, the practical effectiveness of recent iOS updates, the incentives for users to migrate sensitive assets to hardware wallets or cleaner devices, and the broader ecosystem implications for any app that stores credentials or keys in recoverable form. Coverage distinguishes between the documented technical risk and the absence of widespread confirmed exploitation tied to this specific advisory.
Subsequent Apple security notes, independent verification of the fix, or reports of related incidents will determine the lasting significance of the alert.
This analysis draws from Binance’s November 10 security statements, contemporaneous reporting by crypto.news, Cointelegraph, and other outlets, and related researcher disclosures. The exact scope of affected devices, whether recent updates fully mitigate the issue, and any real-world exploitation remain subject to further official confirmation and technical review.