Binance Warns iOS Vulnerability May Expose Crypto Wallet Private Keys

Binance issued an emergency security warning to users regarding an Apple iOS vulnerability, blockmedia.co.kr reported.

The Tech TL;DR:

• An iOS vulnerability dubbed “worse_query” bypasses sandbox protections, potentially exposing app data and private keys.
• Security researchers published exploit code on GitHub, targeting specific iOS versions between 26.0 and 27.2.
• Binance recommends updating devices and shifting assets to secure hardware if compromise is suspected.

Security researchers forcequitOS and 0xjohnny published vulnerability verification code on GitHub, according to blockmedia.co.kr. The flaw, known as “worse_query,” bypasses Apple’s sandbox protection mechanisms which normally restrict inter-app data access.

The exploit utilizes app group containers to reach into other applications’ data stores, system internal directories, and shared storage spaces. Affected versions identified by researchers span iOS 26.0 through 26.7.2, alongside iOS 27.2, as reported by blockmedia.co.kr.

# Conceptual file traversal check for app group containers
import os

def scan_sandbox_containers():
    target_path = "/private/var/mobile/Containers/Shared/AppGroup/"
    if os.path.exists(target_path):
        print(f"Container path accessible: {target_path}")
    else:
        print("Sandbox isolation intact.")

scan_sandbox_containers()

Binance explained that the issue stems from the operating system level rather than the exchange application itself, affecting iOS versions 26.7.1, 27.0.1, and 27.2, blockmedia.co.kr reported. File access does not automatically trigger asset theft, as actual risk depends on how digital asset wallets store recovery phrases and whether malicious apps have auxiliary capabilities.

SlowMist security lead 23pds noted that danger arises specifically when recovery information is stored in an extractable format, according to blockmedia.co.kr.

Apple released security updates iOS 27.2.1 and 26.7.3 addressing nine security problems across AirPlay, Bluetooth, and Messages, though the release notes did not explicitly confirm a fix for the worse_query flaw, blockmedia.co.kr reported. SlowMist’s 23pds stated that iOS 27.2.1 blocked the attack technique, though Apple issued no official confirmation of that specific remediation.

Binance advised users to delete unverified applications, update their operating systems and applications to the latest versions, and generate new wallets on secure devices while terminating old login sessions if a breach is suspected, according to blockmedia.co.kr.

This warning followed a separate October 24 advisory from SlowMist regarding the Darksword attack tool targeting iOS via malicious websites, which involved over 1,500 phishing sites mimicking exchanges and wallets. Blockmedia.co.kr reported that no verified connection exists between this iOS vulnerability and a separate Binance hacking incident on October 29 involving approximately $6.3 billion.

Always consult with certified IT and cybersecurity professionals before altering enterprise networks or handling sensitive data.