Binance warns of iOS flaw that could expose wallet credentials

Binance listed iOS 26.7.1, 27.0.1 and 27.2 among the affected versions, describing the issue as an operating-system vulnerability rather than a flaw specific to its own services. The reported weakness concerns Apple’s application sandbox, which is intended to keep apps from accessing one another’s private files. The repository publishing the proof of concept describes worse_query as a sandbox escape and a developer demonstration, not a jailbreak.

The risk depends on what an app stores locally and how it protects that data. If a wallet keeps recovery phrases, private keys or related credentials in files that become accessible, the information could be exposed. The research does not establish that every wallet stores credentials this way, or identify a confirmed compromise of MetaMask, Phantom or Trust Wallet through worse_query.

Binance advised users to remove apps from untrusted sources, including manually signed or sideloaded IPA files, and to update iOS and installed apps to their latest official versions. Anyone who suspects wallet credentials were compromised should create a new wallet on a clean device, transfer funds and reset active login sessions.

Apple’s release records show iOS 27.2 was released on October 26 and iOS 27.2.1 on November 9. Apple’s security advisories do not name worse_query or confirm that an update fixes the reported access method; no CVE number has been confirmed for it. Other Apple security issues mentioned in advisories, including CVE-2026-86950, have not been established as the same flaw. Binance had not responded to crypto.news’ request for comment by press time.