Binance warned iPhone users on Nov. 10 that an iOS-level vulnerability could let malicious apps read local files belonging to other apps, potentially exposing wallet seed phrases, private keys and login credentials. The exchange said the issue was not limited to Binance products, putting the warning in the wider context of crypto wallets and other sensitive applications stored on affected devices.
The immediate risk described by Binance is the possible disclosure of secrets that can control a wallet or unlock an account. Binance recommended removing untrusted apps, updating iOS and installed applications, and moving funds to wallets created on clean devices where users suspect compromise.
Binance warning covers wallet secrets
In its Nov. 10 notice, Binance said a malicious application could use an iOS vulnerability to access other apps’ local files, exposing data that could include wallet seed phrases and private keys. The company said the issue was an iOS security concern, not one unique to Binance Wallet or its products.
Public proof of concept details sandbox escape
The warning followed the public release of worse_query, a proof of concept that describes a sandbox escape. Its repository says the issue affects iOS 26.0 through 26.7.2 and iOS 27.2, and can provide access to application containers and shared app-group containers without a jailbreak.
The two version lists should not be treated as interchangeable. Cointelegraph reported that Binance identified iOS 26.7.1, 27.0.1 and 27.2 as affected versions, while the proof-of-concept repository describes its own stated scope.
Steps for suspected compromise
Binance’s guidance begins with removing applications installed from untrusted sources and updating both iOS and all apps. Users who believe their device may have been compromised should move their funds to wallets created on clean devices, according to the company’s notice.
As of Binance’s warning, there were no confirmed cases of attackers using the flaw to access wallets or steal funds, Cointelegraph reported. The alert therefore concerns a potential exposure path documented in public technical material, not confirmed wallet theft tied to the vulnerability.
