Binance has issued a security alert warning iPhone users that an unpatched iOS vulnerability could allow malicious applications to access cryptocurrency wallet seed phrases and private keys stored by other apps. According to Bitcoin Magazine, the exchange told customers that a public iOS sandbox escape known as "worse_query" poses a threat to sensitive app data, while Apple's November 9 security updates have so far remained silent on the issue.
The vulnerability, described as a sandbox escape, could theoretically let a rogue app read cryptographic material held by wallet applications that users assume are isolated from one another. Decrypt noted that Apple has not publicly confirmed the worse_query bug, which a researcher published days before Apple rolled out its latest iOS security update. The timing has left users uncertain whether the current patches address the flaw.
While Apple routinely bundles security fixes into iOS releases, the absence of any documented acknowledgment of worse_query has fueled concern among crypto custodians. Cointelegraph reported that it remains unclear whether Apple’s latest iOS updates fix the vulnerability. In the meantime, Binance has advised iPhone owners to remove any applications installed from untrusted sources as a precautionary step.
The risk centers on the iOS sandbox, a core security boundary designed to prevent apps from accessing data belonging to other apps. If worse_query enables an escape from that boundary, a maliciously crafted program downloaded onto a device could scan storage regions or memory segments used by legitimate wallet software and extract recovery phrases or private keys without the victim’s knowledge. Such a breach would effectively grant an attacker full control over any funds secured by the targeted wallet.
Because the bug was publicly disclosed rather than reported through a coordinated private process, the window between publication and any potential patch has become a critical period for mobile crypto users. Security teams typically prefer responsible disclosure that gives vendors time to ship fixes before details become public; in this case, the premature release may have left iOS devices exposed until Apple responds.
Binance’s warning adds to the broader conversation around mobile operating system security for digital assets. Smartphones have become the dominant platform for self-custody and exchange-managed wallets alike, yet their closed ecosystems can delay independent verification of whether a reported flaw has truly been remedied. Users generally must rely on vendor patch notes to confirm that a bug has been closed, and when a company does not list a specific issue, the default assumption is that it remains unpatched.
For now, Binance’s guidance to delete untrusted apps is one of the few available mitigations while the industry waits for Apple to either confirm the vulnerability or issue a targeted fix. The incident also highlights the dependency that mobile wallet providers and exchanges place on platform-level security guarantees that are outside their direct control.