Binance has issued an urgent security warning about an iOS vulnerability called worse_query that could expose sensitive files stored by other applications. The flaw affects iOS 26.7.1, 27.0.1 and 27.2, potentially putting cryptocurrency seed phrases, private keys and account credentials at risk.

In its November 10, 2026, announcement, Binance clarified that the problem originates at the operating system level and is not restricted to its exchange or wallet services. The warning calls for immediate attention from iPhone users.

How worse_query Could Expose Crypto Wallet Data

The worse_query vulnerability allows malicious applications to read local files belonging to other applications. This creates a potential route to sensitive information stored directly on an affected device, including cryptocurrency recovery phrases, private keys and login credentials.

For crypto users, the concern extends beyond Binance accounts. Any application storing sensitive information locally could potentially face exposure if a malicious app exploits the vulnerability.

Binance specifically emphasized that this is an iOS level security issue affecting the broader ecosystem rather than a weakness exclusive to its platform.

The vulnerability therefore raises concerns for users whose wallet information or authentication details remain accessible through local application files.

Binance Recommends Removing Untrusted Apps & Updating iOS

Binance has outlined three immediate security measures for affected users.

First, users should delete applications installed from untrusted sources, particularly sideloaded applications and manually signed IPA packages. These installations can introduce applications that have not undergone the usual official distribution checks.

Second, users should update iOS and all installed applications to their latest official versions. Binance recommends keeping both the operating system and applications current rather than updating only individual wallet software.

Third, users should avoid installing unauthorized packages and continue using official software releases.

These measures are intended to reduce exposure to malicious applications and keep devices running the latest available software.

A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.

Immediate Action Required:

• Delete any apps installed from untrusted sources (such as sideloaded or manually signed IPAs).
• Update iOS and all apps to the latest official versions.
• If you suspect a breach, transfer funds to a new wallet created on a clean device and reset all active login sessions.

Never install unauthorized packages, and keep your software up to date.

— Binance (@binance) November 10, 2026

Suspected Compromise Requires a New Wallet & Session Reset

Binance has provided additional instructions for users who believe their devices or wallet information may already have been compromised.

Such users should transfer their funds to a new wallet created on a clean device. Creating the replacement wallet on a clean device is important because generating it on a potentially compromised phone may leave its credentials exposed.

Users should also reset all active login sessions to prevent unauthorized access through existing authenticated sessions.

The exchange's warning focuses on protecting locally stored wallet secrets and account access rather than treating the issue as a Binance specific incident. Its recommended response combines removing untrusted applications, installing official updates, moving funds to a clean wallet when compromise is suspected, and resetting active sessions.

If you find any issues in this article or notice missing information, please feel free to reach out at team@etherworld.co for clarifications or updates.

To promote your Web3 articles, events, and projects, you may reach out anytime via EtherWorld PR for submissions and collaboration.

Related Articles

1. Dubai VARA Approves Kraken Parent Payward
2. Coinbase Wants Employees to Build AI Models Without Writing Code
3. Gnosis Chain Activates Ethereum Fast Confirmation Rule
4. Starknet Targets Quantum Resistance by 2027
5. 79thVault Loses $12.5M in 79AU Hot Wallet Hack

To follow blockchain news, track Ethereum protocol progress, and read our latest stories, subscribe to our weekly today.

Join the EtherWorld & Avarch Internship Program and build your career in blockchain, content, social media, video, podcast editing, or operations. Send your resume and brief introduction to contact@etherworld.co.