Binance is urging iPhone owners to install iOS updates after researchers disclosed worse_query, a vulnerability that could let malicious software read cryptocurrency wallet secrets and account credentials, Bitdefender reported. Binance identified three affected versions, iOS 26.7.1, 27.0.1 and 27.2, but exploiting the weakness requires malicious code to run on the phone. No cryptocurrency theft has been confirmed as resulting from the flaw.
Apple issued iOS 27.2.1 and iOS 26.7.3 on November 9, with fixes that included CVE-2026-113963, an issue through which an app could obtain sensitive information about users. Whether those updates completely fix worse_query remains uncertain because Apple's security advisories do not name it explicitly. Binance recommends installing official iOS updates, updating apps and deleting software obtained from sources users cannot trust.
Read more: Apple Warns iPhone Users in 110 Countries About Mercenary Spyware Attacks
The weakness concerns iOS itself, according to Binance, so exposure could extend beyond customers using Binance's app. Apps normally run inside separate sandboxes that restrict their access to one another's files, but worse_query can cross some of those boundaries. The degree of danger varies with the protections each wallet applies to its stored secrets.
Researchers have released demonstration code, according to BleepingComputer as cited by Bitdefender. WQ Files, a separate tool using the technique, can retrieve, change or erase data from other apps on an iPhone without a jailbreak. An attacker could attempt to get the necessary malicious software onto a device by persuading its owner to install an app from an untrusted source.
A stolen recovery phrase could let an attacker recreate a wallet on another device and move its funds without permission. Binance advises keeping those phrases offline instead of saving them as phone screenshots, photos, notes or unencrypted documents. For people with substantial holdings, it also recommends considering a hardware wallet to separate private keys from a potentially compromised phone.
Apple's earlier iOS 26.5 update addressed more than 60 vulnerabilities across components including Kernel and WebKit. That update also fixed CVE-2026-28995 in App Intents, a separate weakness that could allow malicious software to break out of its sandbox.
Users who suspect a compromise should establish a fresh wallet using a clean, trusted device, move remaining funds and revoke affected account sessions, Binance advises. Bitdefender also warns that scammers exploit security scares with messages directing people to surrender recovery phrases; legitimate wallet providers do not need those phrases for account verification or security updates.
