Binance warned that a security vulnerability discovered in Apple's iPhone operating system could expose cryptocurrency wallet private keys and recovery phrases. The global crypto exchange explained that the 'worse_query' vulnerability allows malicious apps to access files stored in other applications, potentially compromising wallet security data. The vulnerability affects iOS versions 26.7.1, 27.0.1, and 27.2, according to Binance's security advisory. Security concerns have intensified as Apple's latest iOS updates have not explicitly confirmed whether the vulnerability has been patched, with researchers claiming the issue remains unresolved in newer versions.
worse_query Vulnerability Bypasses iOS Sandbox Protection
Binance stated in its security notice that "the worse_query vulnerability discovered in iPhone allows access to files stored in other apps," adding that "this process could expose private keys, recovery phrases, and login information stored in cryptocurrency wallets." Private keys and recovery phrases are critical information used to access or restore cryptocurrency wallets. If attackers obtain these credentials, they can access wallets without user consent and steal assets.
The vulnerability bypasses the iOS "sandbox" security feature that separates storage space for each app on iPhones. Normally, apps installed on iPhones cannot view or modify internal files of other apps. Access is restricted to prevent one app from arbitrarily checking account information or data stored in another app. However, using worse_query allows circumvention of these restrictions to access folders where other apps' data is stored. Materials published on GitHub by researchers specify iOS 26.0 through 26.7.2 and iOS 27.2 as the affected range.
Apple Releases iOS Updates Without Explicit Fix Confirmation
Security researcher forcequitOS publicly disclosed the worse_query vulnerability through GitHub on the 9th (local time), before Binance's announcement. Apple subsequently released iOS 27.2.1 and 26.7.3 on the same day, but the published security guidance did not specify whether the worse_query vulnerability was fixed. Based on this, forcequitOS claimed the vulnerability remains unpatched in iOS 27.2.1 and iOS 27.3 beta 1.
Developer Releases WQ Files Tool Demonstrating Exploit
A program capable of actually viewing, modifying, or deleting other apps' files using this vulnerability was also released. Developer Christoph Kolbicz published 'WQ Files' on GitHub on the 9th, a program designed to access internal files of other apps without jailbreaking the iPhone. Jailbreaking is the process of removing security restrictions set by Apple in the operating system. However, according to the developer's explanation, WQ Files can view, back up, modify, or delete files from other apps without jailbreaking or obtaining core operating system privileges.
The program has been updated multiple times since its initial release on the 9th. From the initial version, it provided functions to view, modify, delete, back up, or restore data from other apps' files, with file search and editing features added subsequently. The developer stated that the program was confirmed to work on iOS 26.7.1, 27.0.1, and 27.2. However, using the program requires a separate app installation tool, and "App Group" permissions used for data sharing between apps must also be maintained.
Cryptocurrency Wallets Face Private Key Exposure Risk
Cryptocurrency wallets are a concern because some wallet apps store private keys, recovery phrases, and account-related information inside smartphones. If a malicious app uses the vulnerability to access a wallet app's internal files, this information could potentially be exposed. Particularly if private keys or recovery phrases are stored in an unencrypted state, attackers could obtain them to restore wallets on other devices or move assets without authorization.
However, no cases of cryptocurrency theft using this vulnerability have been confirmed to date. A Binance spokesperson told CryptoNews in an interview on the 10th that "no cases have been confirmed so far of accessing cryptocurrency wallets or stealing assets using worse_query."
Binance Issues Security Recommendations for Users
Binance recommended that users delete apps from unclear sources and update their operating systems and apps to the latest versions. The exchange also advised that if users suspect their private keys or recovery phrases have been exposed, they should create a new wallet on a secure device, transfer their assets, and terminate existing login sessions.
FAQ
What is the worse_query vulnerability that Binance warned about?
The worse_query vulnerability is a security flaw in Apple's iPhone operating system that allows malicious apps to bypass the iOS sandbox protection and access files stored in other applications. Binance explained this vulnerability could expose cryptocurrency wallet private keys, recovery phrases, and login information stored on affected devices.
Which iOS versions are affected by the worse_query vulnerability?
According to Binance, the vulnerability affects iOS versions 26.7.1, 27.0.1, and 27.2. Materials published by researchers on GitHub specify iOS 26.0 through 26.7.2 and iOS 27.2 as the affected range.
Have there been any confirmed cases of cryptocurrency theft using this vulnerability?
No. A Binance spokesperson stated in an interview on the 10th that "no cases have been confirmed so far of accessing cryptocurrency wallets or stealing assets using worse_query."
