iOS flaw: Binance urges iPhone users with crypto to update

What happened. Binance posted the warning on X on November 10. It says worse_query affects iOS 26.7.1, 27.0.1 and 27.2. A malicious app can read local files of other apps, which can hold seed phrases, private keys and login data.

Where it came from. A researcher who goes by forcequitOS published worse_query on GitHub on November 8. It is described as a sandbox escape for iOS 26.0 through 26.7.2 and 27.2. The sandbox is the wall that keeps each app in its own folder. The author calls it a proof of concept for developers that isn't useful by itself. But the code is public, so others can build on it.

What Apple did. iOS 27.2.1 came out on November 9 for iPhone 11 and later. Its security notes list nine fixes. One is in App Intents: an authorization issue through which an app may be able to access sensitive user data. The notes do not mention worse_query. Apple has not publicly said whether the update closes this exact hole.

What Binance advises. Delete apps from untrusted sources, meaning anything installed outside the App Store. Update iOS and all apps to the latest official versions. If you suspect a breach, move funds to a new wallet created on a clean device and reset all active login sessions.

What to keep in mind. To use the flaw, a malicious app has to be on the phone already. The biggest risk is for people who install apps outside the App Store. According to Decrypt, there are no confirmed thefts through worse_query so far.

Confirmed facts

• On November 10 Binance warned that worse_query, a flaw in iOS 26.7.1, 27.0.1 and 27.2, lets malicious apps read other apps' local files, including seed phrases, private keys and logins.^[2]
• Binance called it an iOS-level issue that is not unique to Binance.^[2]
• worse_query was published on GitHub on November 8 as a sandbox escape for iOS 26.0-26.7.2 and 27.2; the author calls it a proof of concept for developers.^[3]
• Apple released iOS 27.2.1 on November 9 with nine security fixes, one in App Intents where an app may be able to access sensitive user data.^[1]
• Apple's iOS 27.2.1 notes do not mention worse_query.^[1][2]
• Binance advises deleting apps from untrusted sources, updating iOS and apps, and moving funds to a new wallet on a clean device if a breach is suspected.^[2]
• There are no confirmed reports of crypto stolen using this flaw so far.^[2]

Implications

• ConfirmedPeople with crypto wallets on an iPhone should update iOS and review their apps.
• Our readingThe highest risk is for people who install apps outside the App Store. This is our inference.
• Our readingPublic exploit code raises the chance someone tries to use it. This is our inference.

Still unknown

• Whether iOS 27.2.1 closes worse_query itself
• Whether any real thefts have used the flaw
• Whether Apple will ship a dedicated fix

Who it affects

Global. Anyone who keeps crypto or keys in iPhone apps

Sources

1. Apple: About the security content of iOS 27.2.1 and iPadOS 27.2.1 November 9, 2026 · official
2. Decrypt: Binance Warns of Apple iOS Flaw That Could Expose iPhone Users' Private Keys November 10, 2026 · media
3. GitHub (forcequitOS): worse_query: a sandbox escape for iOS 26 and 27 November 8, 2026 · official