A publicly released iOS sandbox escape exploit called “worse_query” could let a malicious app read seed phrases, private keys and login credentials from other apps, and Apple has not confirmed a fix. Binance has warned users, though no attacks or thefts have been reported.
Researchers forcequit and 0xjohnny published the exploit on Sunday, November 9, one day before Apple shipped its latest iOS updates.
What the worse_query Exploit Allows on iOS 26 and 27
The exploit affects iOS 26 and 27. A malicious app that uses it can read sensitive data from other apps on the device without a jailbreak, including crypto wallet seed phrases, private keys and login credentials. The exploit requires an App Group container, and sideloading tools such as AltStore and SideStore make it possible to install an app that carries the exploit.
The App Store review process is not part of the installation path described. The exposure therefore concentrates on users who install apps from outside Apple’s official store.
Apple’s Updates Do Not Mention the Bug
Apple released iOS 27.2.1 and 26.7.3 on November 10. Neither update’s notes mention the vulnerability, and no fix has been confirmed. Because Apple has not acknowledged the flaw, it is unclear whether the updates change the behavior or whether the exploit still works on patched devices.
Binance Tells Users to Delete Untrusted Apps
On November 10, Binance issued guidance for users. It told them to delete apps from untrusted sources and, if they suspect their device is compromised, to move funds to new wallets created on clean devices.
The advice reflects the nature of the exposure. A seed phrase or private key that an attacker may have read cannot be revoked in the way a password can; the only reliable remedy is to move assets to a wallet with new keys.
No Attacks or Thefts Yet Reported Against Wallets
No attacks or thefts have been reported. The risk is currently theoretical, but the combination of a public exploit and no confirmed patch means the situation could change as other developers adapt the code. Any iPhone user who has sideloaded apps and also holds crypto wallets is theoretically exposed.
Why a Public Exploit Without a Patch Raises the Stakes
Publishing a working exploit before the vendor confirms a fix shifts the balance toward attackers, who can study and adapt the code while defenders wait. Wallet theft is also irreversible by design, so even a small number of successful attacks could cause permanent losses for the affected users.
The reliance on sideloading limits the likely victim pool compared with a flaw that could be exploited through the App Store. Still, the groups that sideload apps include precisely the crypto-focused and power users who tend to hold sizable wallets, a point that makes the data an attractive target.
Until Apple addresses the issue, the practical safeguards are those outlined by Binance: avoid installing apps from untrusted sources and treat any device that ran such an app as potentially compromised. Users who hold funds on an iPhone that has had sideloaded software installed face the clearest decision about whether to migrate to a new wallet.
Who Is Exposed to the worse_query Exploit and Who Is Not
Users who install apps only from the App Store and have not used tools such as AltStore or SideStore fall outside the installation path the researchers describe. The exposed group is narrower than the whole iOS user base: people who sideload apps and keep seed phrases, private keys or login credentials in other apps on the same device.
For them, the Binance advice has a concrete order of steps. Delete apps from untrusted sources first. If compromise is suspected, create new wallets on a clean device and move funds there, since a key that may have been read cannot be made safe again.
