A seed phrase is the one secret that cannot be reset: whoever reads it controls the wallet. On Nov. 10, the crypto exchange Binance warned in a post on X that a sandbox flaw in iOS, nicknamed “worse_query,” could let a malicious app read other apps’ private files, including seed phrases, private keys and login credentials. The exchange said the risk reaches wallets “across the entire ecosystem” and is not limited to its own app.
Read next on Morning Overview: Cadillac cut the price of its cheapest EV, which goes up to 317 miles on a charge
No cryptocurrency losses have been confirmed, according to BleepingComputer’s report on the warning. Still, a working demonstration tool is public, and whether Apple’s latest patch closes the hole remains unclear.
What Binance says is exposed on iOS 26.7.1, 27.0.1 and 27.2
Binance named three affected releases: iOS 26.7.1, 27.0.1 and 27.2. The exchange’s statement, relayed by BleepingComputer on Nov. 10, describes an issue at the operating-system level. Any app storing sensitive material locally, from a wallet to a password manager, would sit in the blast radius if another app on the same phone could reach across the boundary meant to keep them apart.
The precaution Binance recommends is plain: install the available update immediately, delete unnecessary and untrusted apps, and keep iOS and other apps current. For anyone who suspects a compromise, the exchange advises creating a new wallet on a clean device, moving funds there, and resetting every active login session.
The public proof of concept and the sideloading catch
The technique behind the warning is documented in a public repository, worse_query on GitHub, run by an account called forcequitOS. Its README calls the project a proof of concept for developers that is not useful by itself, and says it gives an app access to system and app-data paths outside its normal sandbox, including shared App Group containers and application data folders. A user must create an App Group container for the app to use it. The repository lists iOS 26.0 through 26.7.2 and 27.2 as targets, a slightly wider range than the three releases Binance cited.
BleepingComputer reports that a tool called WQ Files appeared the day before its article. It uses the technique to browse, export, edit and delete other apps’ data without a jailbreak, and it has been confirmed to work on the three versions Binance listed. The catch is delivery: the tool has to be installed on the iPhone, so an attacker would have to persuade a target to sideload it from outside the App Store. That requirement narrows the realistic audience, though it does not remove it.
For wallet holders the sideloading condition suggests a concrete order of operations. Checking which apps on the phone came from outside the App Store comes first, because an app the owner installed knowingly is the likeliest carrier of a tool like this. Updating to the newest iOS build comes second, since Apple’s Nov. 9 release is the only fix on the table. Anyone holding large balances in a software wallet may also weigh moving them to hardware storage, a step Binance did not mention.
Apple’s Nov. 9 updates and the unanswered question
One day before the Binance post, Apple shipped iOS 27.2.1, iOS 26.7.3 and iOS 18.7.12. According to Apple’s security notes for the update, the release covers iPhone 11 and later along with a range of iPad models, and it fixes nine flaws. One entry, CVE-2026-113963, states that an app may be able to access sensitive user data and says an authorization issue was addressed with improved state management. The credit goes to researcher László Várady.
Whether that entry is the same problem Binance describes is not established. BleepingComputer says it is unclear, and its reporting notes the researcher found the access happening through App Intents rather than App Group containers, which are the paths the public repository emphasizes. The fetched Apple page lists no entry that mentions a sandbox escape by name. BleepingComputer also says it has asked Apple for comment and will update its article if the company responds.
Apple publishes the full history of its fixes on its security releases index, which is where a follow-up advisory would appear if the company ties a patch to this technique. Until then, the safest reading is conditional: iPhones on the newest build have received a fix for something that sounds related, and the status of the specific method Binance flagged has not been confirmed by Apple.
The original claim sits on Binance’s post on X, which is the exchange’s own statement rather than an independent audit. No researcher has been quoted in the coverage reviewed saying funds were taken, and the public record so far describes capability and risk, not a loss. Readers following the story should watch for any Apple advisory that names the sandbox issue, and for confirmation from Binance of an actual theft. Until either arrives, the confirmed facts are a public tool, a warning from an exchange with its own interests, and a patch whose scope Apple has not described.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
- 11 engines built to run well past 200,000 miles
- Two Kentucky residents died when a small plane crashed at Missouri’s Lake of the Ozarks, and the NTSB is investigating
- A handful of car transmissions are so tough that mechanics say they almost never die
- Melting permafrost is setting off a newly identified kind of catastrophic landslide, scientists say
