Binance warns of iOS sandbox escape risk to crypto wallet keys
- Binance issued a warning about an iOS sandbox escape vulnerability named worsequery.
- The flaw potentially exposes sensitive data like private keys and recovery phrases.
- Apple released iOS 27.2.1 on November 9, 2026, but did not confirm a fix for the issue.
- Users are advised to delete untrusted apps and move funds to clean devices if compromised.
Binance has issued a security warning regarding an iOS sandbox escape vulnerability that could potentially allow malicious applications to access sensitive information including crypto wallet recovery phrases, private keys, and login credentials. The vulnerability, referred to as "worsequery," enables malicious applications to bypass sandbox isolation and read private files belonging to other applications on iPhones.
This issue exposes sensitive user data on devices running iOS 26 and 27, according to reports from The Hacker News, Cryptonews, and Cointelegraph on November 10, 2026.
Mechanics of the worsequery proof of concept
The "worsequery" proof-of-concept code functions by accessing all application data containers on an iPhone and specific system folders on iOS 27, provided the malicious app establishes an App Group container. Developer Christoph Kolbicz created a file manager app named "WQ Files" utilizing this vulnerability, which allows for the editing, deletion, and clearing of data from other applications without requiring a jailbreak or kernel exploit.
The "WQ Files" app is installed through sideloading tools such as SideStore or AltStore, which automatically generate the necessary App Group container when used with an Apple ID. It then requests a file-access permission token through the container-management service to gain unauthorized access.
Affected iOS versions identified by researchers
Researchers have identified specific versions of iOS 26 and 27 as vulnerable to the "worsequery" sandbox escape risk.
Cryptonews and The Defiant both confirm the vulnerability impacts the range of versions from 26.0 to 26.7.2 and 27.2.
Apple updates released without confirmed worsequery fix
These updates addressed several Bluetooth bugs and two iMessage flaws, but the security documentation does not mention the worsequery vulnerability or sandbox issues.
It remains unconfirmed whether the latest software updates resolve the security risk. A GitHub project reported on November 8, 2026, that the worsequery exploit remains unpatched in the latest available Apple software releases.
Binance and SlowMist security recommendations
Binance advises users to delete applications installed from untrusted sources, such as manually signed or sideloaded apps, to protect their data. Users should keep their iOS and applications updated to the latest versions.
SlowMist suggests that users who have installed untrusted apps should move their assets to a new wallet on a clean device.
SlowMist also recommends that wallet developers avoid storing sensitive information in plaintext to mitigate risks associated with sandbox-escape vulnerabilities.
Scope of the iOS level security risk
Binance serves more than 200 million users globally and stated the worsequery issue is an operating system flaw rather than a platform-specific problem. The security risk stems from the fact that secrets are stored locally in plaintext.
SlowMist issued a warning on November 10, 2026, regarding this public proof of concept that could undermine security assumptions about isolation between application containers. The bug does not steal assets independently, but it could expose locally stored plaintext secrets like seed phrases if a user installs an untrusted application.
No instances of theft or attacks involving this vulnerability have been reported by the exchange or the researcher.
Historical context of mobile security threats
Binance previously warned users in September about the FomoPeek application, specifically versions 1.1 and 1.2. These versions contained malicious code capable of obtaining elevated device privileges and accessing locally stored data.
Frequently Asked Questions
- Binance Warns of iOS Sandbox Escape That Could Expose Crypto Wallet Keys, No Fix Confirmed (thehackernews.com)
- Your iPhone Duo Under Attack? Binance Flags Dangerous iOS Security Flaw (cryptonews.com)
- SlowMist Flags iOS Sandbox Escape Risk to Wallet Data | The Defiant (thedefiant.io)
- Binance (tavily.com)
- Binance warns iOS flaw could expose crypto wallet keys (cointelegraph.com)
Add NewsPulse Time as a preferred source on Google