Binance Warns of iOS Flaw That Could Expose Crypto Keys

Binance warned on November 10 that a publicly disclosed iOS sandbox technique could let malicious apps access files belonging to other apps, potentially exposing cryptocurrency seed phrases, private keys and login credentials. The exchange said the issue affects iOS, not Binance specifically, and identified iOS 26.7.1, 27.0.1 and 27.2 as versions of concern.

The technique, called worse_query, was published as proof-of-concept code by a researcher using the name forcequitOS. It exploits an App Group container to reach data ordinarily protected by iOS app isolation. The researcher said an app must set up such a container to use the method and that the demonstration code is not useful by itself. Access to files does not automatically give an attacker control of a wallet; exposure would depend on what sensitive information an app stores and whether malicious software can collect it.

Apple released iOS 27.2.1 and iOS 26.7.3 on November 9. The updates’ published security notes do not mention worse_query or confirm that the technique has been fixed. A SlowMist executive identified as 23pds said iOS 27.2.1 blocks it, but that assessment was not confirmed in Apple’s release notes.