Binance Warns of Worse_Query iOS Crypto Theft Risk - Daily Beirut
Binance has warned users about a critical iOS vulnerability named Worse_Query that could expose cryptocurrency wallet credentials and lead to asset theft.
Binance highlighted on November 10th that this vulnerability impacts iOS versions 26.7.1, 27.0.1, and 27.2. The security flaw, identified as Worse_Query, bypasses the standard iOS sandbox mechanism that restricts unauthorized access between applications. Researchers have released test code and a tool called WQ Files, which enables users to access, copy, edit, and delete data from other applications without a jailbroken device.
Risks to digital assets
The primary concern for cryptocurrency holders is the exposure of sensitive credentials such as wallet recovery phrases, private keys, or login information. If malicious actors obtain these recovery phrases, they can restore the wallet on a separate device and transfer assets without the owner's consent. Binance clarified that this defect resides at the Apple operating system level rather than being specific to the exchange's own application.
Binance advises users to remove unnecessary applications or those installed from unreliable sources. It is also recommended to update both iOS and all apps to the latest official versions. In cases where a device is suspected of compromise, users should transfer assets to a newly created wallet on a secure device and re-establish any active login sessions.
Patch status
Apple issued updates for iOS 27.2.1 and 26.7.3 on November 9th to address various security vulnerabilities. Despite these releases, official announcements have not clearly confirmed how Worse_Query was remediated. Some researchers indicate the vulnerability persists post-update, though no confirmed reports exist of cryptocurrency assets being stolen via this specific flaw. The extent of the risk varies depending on how individual applications store and protect their data.
Related
