Binance has issued a warning about an iOS security vulnerability known as worse_query, which could potentially allow malicious applications to access private data belonging to other applications on thBinance has issued a warning about an iOS security vulnerability known as worse_query, which could potentially allow malicious applications to access private data belonging to other applications on th

Binance Warns of iOS Worse_Query Vulnerability: Crypto Wallet Seed Phrases and Private Keys Could Be Exposed

#Industry Perspectives

NOT$0.0003335+2.48%

4$0.0088+0.80%

PUBLIC$0.003842-2.41%

Author: Nguyen Rin Hoang

2026/11/13 16:18

Notably, the data at risk may include not only login credentials but also seed phrases and private keys stored in cryptocurrency wallet applications.

This issue is not limited to Binance but is related to the security mechanisms of the iOS operating system. If exploited, the vulnerability could pose risks to numerous financial applications and crypto wallets operating on iPhones.

Although no confirmed cases of cryptocurrency asset losses have been linked to the incident, this warning highlights an important issue: the security of digital assets depends not only on blockchain technology or wallet applications but also on the ability of users' devices to protect sensitive information.

Key Takeaways

Binance has warned that the worse_query vulnerability in iOS could allow malicious applications to access data belonging to other applications.

Potentially exposed information includes seed phrases, private keys, and login credentials for crypto wallets.

This is an operating system-level security issue, not a vulnerability specific to Binance.

Security researchers have publicly released Proof of Concept (PoC) code, making the issue more concerning.

Apple has released new security updates but has not clearly confirmed whether the specific worse_query vulnerability has been fixed.

Binance stated that no confirmed cases of crypto asset theft related to this vulnerability have been reported.

1. What Happened with the Worse_Query Vulnerability on iOS?

On November 10, 2026, Binance issued a warning about a security vulnerability known as worse_query in the iOS operating system.

According to Binance, the vulnerability affects certain iOS versions, including iOS 26.7.1, 27.0.1, and 27.2. Malicious applications could exploit weaknesses in the data protection mechanism to access local files belonging to other applications.

This is particularly concerning for the cryptocurrency sector because many wallet applications may store certain sensitive information directly on users' devices.

If this information is not properly protected, it could become a target for malicious applications.

The potentially affected information includes:

Seed phrases: Wallet recovery phrases that can allow others to restore access to a wallet.

Private keys: Secret keys used to control wallets and sign blockchain transactions.

Login credentials: Authentication information belonging to financial applications and crypto services.

Application data: Certain local files that the operating system is designed to protect from access by other applications.

An important point is that Binance emphasized this is not an incident specific to its platform. The issue originates from the iOS security layer and could affect a broader application ecosystem.

2. How Dangerous Is Worse_Query?

To understand the severity of this incident, it is important to examine the iOS Sandbox mechanism.

Normally, the operating system uses Sandbox technology to isolate application data. Each application has its own storage environment and is not permitted to access private data belonging to other applications without authorization.

This mechanism plays an important role in protecting personal information, account details, and financial data on iPhones.

However, worse_query has been publicly described as a technique for bypassing these security boundaries, also known as a Sandbox Escape.

If a malicious application successfully exploits this weakness, it could potentially access data that would normally be outside its authorized permissions.

This is particularly concerning because users generally trust that the operating system completely isolates the data stored within each application.

When this protection mechanism contains a vulnerability, the potential risks can extend beyond a single application.

However, it is important to understand that the existence of this vulnerability does not mean all applications on iPhones are automatically having their data stolen. Whether sensitive information can be accessed still depends on the exploit's capabilities, how applications store their data, and whether a malicious application is present on the device.

3. Why Should Crypto Wallet Users Be Particularly Concerned?

Unlike ordinary online accounts, control over assets in many types of crypto wallets depends directly on private keys or seed phrases.

In many cases, anyone who possesses a wallet's seed phrase can restore access to that wallet without requiring permission from an intermediary platform.

This creates a particular risk when wallet recovery information is stored on mobile devices.

For example, a user may use an iPhone to manage multiple crypto wallets, monitor an investment portfolio, and authorize transactions. If a malicious application can access private data belonging to other applications, sensitive information stored locally could be exposed to unauthorized access.

Once a seed phrase or private key is exposed, users may lose control of their wallets if that information is used to access their assets.

An important point is that blockchain transactions cannot automatically be reversed simply because a wallet owner has had their private key stolen.

This demonstrates why personal device security is an essential part of protecting digital assets.

However, not all crypto wallets use the same key storage mechanisms. Some applications implement their own encryption and secure storage methods. Therefore, it cannot be concluded that every iPhone user's private keys and seed phrases are equally at risk.

4. Public Release of Proof of Concept Code Makes the Risk More Concerning

One of the factors attracting significant attention to worse_query is that a security researcher operating under the name forcequitOS publicly released Proof of Concept code on GitHub on November 8, 2026.

A PoC is a demonstration that a vulnerability exists or that an exploitation method is technically possible under experimental conditions.

According to the project's public documentation, worse_query is described as a technique for bypassing Sandbox protections on iOS versions 26 and 27.

The public release of the research code gives the security community additional material to assess the potential impact and examine the operating system's defensive capabilities.

However, it is important to distinguish between a PoC and an actual cyberattack campaign.

The existence of code demonstrating a vulnerability does not mean that large numbers of devices have already been compromised or that crypto assets have been stolen.

According to BleepingComputer, the exploit tool must first be installed on a device before it can perform data access operations. This makes the origin and trustworthiness of installed applications important factors when assessing the risk.

Nevertheless, once a technique for bypassing security protections becomes publicly available, users should exercise greater caution with applications from unknown sources and software installed outside official distribution channels.

5. Has Apple Released an Update, and Has Worse_Query Been Fixed?

This is one of the most important questions surrounding the incident.

On November 9, 2026, Apple released several security updates, including iOS 27.2.1, iOS 26.7.3, and iOS 18.7.12.

In the security notes for iOS 27.2.1, Apple mentioned a vulnerability in the App Intents component, identified as CVE-2026-113963. This flaw could allow an application to access sensitive user data.

However, there has been no confirmation that the App Intents vulnerability is the same as worse_query.

The two issues have been described as involving different technical mechanisms. Therefore, it cannot be assumed that installing the latest update automatically means the worse_query vulnerability has been fully addressed.

This creates an information gap for iPhone users.

Updating iOS remains a necessary measure for receiving official security patches, but users should also continue monitoring announcements from Apple and technical confirmations regarding worse_query.

In particular, users of devices that no longer receive security updates should pay closer attention to the risks posed by unpatched vulnerabilities.

6. Not Just Binance: The Entire Crypto Wallet Ecosystem Needs to Pay Attention

One notable aspect of this incident is that its potential impact is not limited to a single trading platform.

Crypto users today often use multiple applications on their phones simultaneously, including non-custodial wallets, cryptocurrency exchanges, banking applications, and authentication services.

These applications may store different types of sensitive information.

If an operating system-level vulnerability allows application isolation mechanisms to be bypassed, risks could emerge across multiple layers of the digital financial ecosystem.

This also places additional responsibilities on crypto wallet developers.

Rather than focusing exclusively on smart contract security or blockchain infrastructure, developers need to pay greater attention to how private keys are stored and protected on users' devices.

A wallet application may operate on a secure blockchain while still containing vulnerabilities if sensitive information is not properly protected at the device level.

Therefore, digital asset security needs to be approached comprehensively, covering the operating system, wallet applications, authentication mechanisms, and private key management procedures.

7. What Should iPhone Users Do to Protect Their Crypto Assets?

Following Binance's warning, iPhone users should pay attention to several basic security measures.

Update the Operating System and Applications

Users should install the latest official iOS updates supported by their devices. They should also keep their wallet applications and financial services up to date.

Updating does not guarantee that worse_query has been fixed without official confirmation, but it ensures that devices receive the security patches Apple has released.

Avoid Applications from Unknown Sources

Users should avoid installing untrusted applications or installation files distributed through unidentified sources.

This is particularly important because the potential exploitation of worse_query is associated with malicious applications being present on the device.

Avoid Storing Seed Phrases as Plain Text

Users should avoid storing wallet recovery phrases in screenshots, note-taking applications, or other locations that are not designed to protect confidential information.

Pay Attention to Device Security Status

For iPhones that are too old to receive security updates from Apple, users should reassess the device's safety when using it to manage digital assets.

If users suspect that their devices have been compromised, they should contact the wallet platform's security support team for guidance on handling the situation safely.

What Happens Next?

Over the coming period, three factors will be worth monitoring regarding the worse_query incident.

First, Apple's Official Response.

This is the most important factor in determining the scope of the vulnerability and the status of remediation efforts. A clear confirmation from Apple would help users understand which iOS versions are protected against this exploitation technique.

Second, Assessments from Blockchain Security Companies.

Security firms specializing in blockchain analysis, such as SlowMist, will continue to play an important role in evaluating risks to wallet applications and the ways sensitive information is stored.

Third, Responses from Crypto Wallet Developers.

Wallet platforms may need to review their mechanisms for storing private keys, seed phrases, and authentication credentials on mobile devices.

Strengthening data encryption, using secure storage environments, and restricting unnecessary access permissions will be important measures for minimizing potential damage if similar operating system vulnerabilities emerge.

Conclusion

Binance's warning about worse_query highlights an important issue in digital asset security: a secure blockchain does not necessarily mean that the entire system users rely on to manage their assets is equally secure.

An operating system-level vulnerability could create risks for multiple applications simultaneously, particularly when those applications store sensitive information such as seed phrases, private keys, and login credentials.

What makes this situation particularly concerning is that Proof of Concept code has been publicly released, while Apple has not clearly confirmed whether its latest updates have fixed this specific vulnerability. Although no confirmed crypto losses have been reported, users still need to proactively review and strengthen their device security.

Over the long term, this incident also serves as a reminder to the entire crypto industry that security cannot focus solely on blockchain networks or smart contracts. Personal devices, operating systems, and the way applications store private keys are all critical components of digital asset protection.

FAQ

1. What is Worse_Query?

Worse_query is a technique for exploiting an iOS Sandbox Escape vulnerability, potentially allowing applications to bypass data isolation mechanisms and access files belonging to other applications.

2. Does the Worse_Query vulnerability only affect Binance?

No. According to Binance, this is an operating system-level security issue involving iOS, not a vulnerability specific to the Binance application.

3. Can private keys and seed phrases be stolen?

There is a potential risk, particularly if wallet applications store this information in a form that can be accessed on the device. However, it cannot be concluded that all crypto wallets on iPhones have had their information exposed.

4. Has Apple fixed Worse_Query?

Apple released security updates on November 9, 2026. However, there is currently no clear confirmation that these updates specifically address the worse_query exploitation technique.

5. Have there been any crypto losses caused by Worse_Query?

According to Binance, no confirmed cases of wallet theft or asset losses linked to this vulnerability had been reported at the time the warning was issued.

6. What should iPhone users do to reduce the risk?

Users should update iOS, install applications only from official sources, avoid storing seed phrases as plain text, and monitor security announcements from Apple and wallet developers.

Disclaimer: The information provided here is for informational purposes only and should not be considered financial, investment, legal, or professional advice. Always conduct your own research, consider your financial situation, and, if necessary, consult with a licensed professional before making any decisions.

Market Opportunity

Notcoin Price(NOT)

$0.0003339

$0.0003339$0.0003339

USD

Notcoin (NOT) Live Price Chart

The articles shared on this page are sourced from public platforms and are provided for reference only. They do not represent the position or views of MEXC. All rights belong to Nguyen Rin Hoang. If you believe any content infringes upon the rights of a third party, please contact [email protected] for prompt removal. MEXC does not guarantee the accuracy, completeness, or timeliness of any content and is not responsible for any actions taken based on the information provided. The content does not constitute financial, legal, or other professional advice, nor should it be interpreted as a recommendation or endorsement by MEXC. For expert insights and in-depth analysis, visit MEXC Learn.