Binance warns iOS sandbox escape could expose crypto wallet secrets

Binance warned that an iOS sandbox escape called worse_query could allow malicious apps to read files from other apps, potentially exposing cryptocurrency wallet seed phrases, private keys, and login credentials.

Binance operates a cryptocurrency exchange, while self-custody wallets let users control funds through their own cryptographic keys. Exposing a wallet’s seed phrase or private key can let someone else take control of its assets, making access to locally stored secrets particularly consequential.

In its warning published today, the cryptocurrency exchange identified iOS 26.7.1, 27.0.1, and 27.2 as affected and urged users to remove apps installed from untrusted sources. It stressed that the problem concerns iOS itself and extends beyond Binance.

The public proof of concept, published by researcher forcequitOS , describes a broader range of supported iOS versions, from 26.0 through 26.7.2, alongside iOS 27.2. The researcher calls worse_query the successor to an earlier technique named bad_query and describes the standalone code as a developer proof of concept.

Crossing app boundaries

iOS normally isolates apps in sandboxes to prevent one application from freely reading another’s private files. According to the researcher, worse_query can access app data containers, extension data, internal daemon containers, and shared App Group storage, with additional system paths accessible on iOS 27.

The technique requires the app using it to have an App Group container. It does not require a jailbreak.

Developer Christoph Kolbicz has already built WQ Files , a file browser and app data manager that reimplements the technique without a kernel exploit. Its documentation lists testing on the same three iOS versions highlighted by Binance.

Beyond browsing files, WQ Files supports backing up, restoring, editing, and clearing other apps’ data.

These capabilities illustrate why a malicious app using the technique could threaten private information. Actual exposure would depend on what the targeted apps store in accessible files and whether that information has additional protection. The documentation does not establish that worse_query can decrypt every wallet or bypass all credential protections.

Patch status remains unconfirmed

Apple released iOS 27.2.1 and iOS 26.7.3 yesterday . Neither published security advisory identifies worse_query or explicitly links a fix to the technique.

The available information does not confirm whether the latest releases block the escape.

Binance’s warning does not report confirmed exploitation or cryptocurrency theft involving it.

Binance advises users to delete apps obtained from untrusted sources, including sideloaded or manually signed IPA packages, and install the latest official iOS and app updates.

Anyone who suspects compromise should move funds to a new wallet created on a clean device and reset active login sessions. Removing a suspicious app cannot revoke a seed phrase or private key that has already been copied.