Binance warned iPhone users on Nov. 10 about an iOS security flaw called worse_query that could let a malicious app break out of its sandbox and reach files tied to other apps. If those files hold crypto wallet recovery phrases, private keys or login credentials, the damage could be immediate.
The warning landed one day after Apple released iOS 27.2.1 and iOS 26.7.3, but the release notes do not say whether either update fixes worse_query. That leaves users with a blunt instruction for now: remove apps downloaded from untrusted sources, install official iOS and app updates, and, if they think a device has been compromised, build new wallets on a clean device, move the assets and reset active login sessions.
Binance's concern carries more weight because the exchange said the flaw is an iOS-level issue, not something unique to its own app. That matters for a large pool of users, with roughly one in four active smartphones worldwide running iPhone hardware, and it matters even more for crypto holders, who often keep exactly the kind of access data that a rogue app would try to find first.
The unresolved problem is simple and uncomfortable: neither Binance nor the researcher has reported attacks or thefts tied to worse_query so far, even though the flaw could expose highly sensitive data if it reaches an affected device. Binance's warning follows its Oct. 29 cyberattack, when compromised employee computers were used to access the exchange's internal wallet-signing service and initiate unauthorized transactions affecting approximately $6.34 billion in digital assets, a reminder that in crypto, a weakness does not need to be famous to be dangerous.
For now, the key question is not whether worse_query sounds serious. It does. The question is which devices and apps are actually exposed, because Binance has not identified a specific wallet application as vulnerable, and Apple's latest updates have not yet been confirmed as the fix users need.
