iOS Worse_query Bug Exposed Private Keys on iPhone

On November 10, 2026, Binance published a security advisory flagging a critical vulnerability in Apple's iOS operating system. The flaw, designated worse_query, affects iOS versions 26.7.1, 27.0.1, and 27.2. It targets Apple's application sandbox, a security layer designed to prevent installed apps from accessing another app's private files without authorization. When that sandbox fails, every crypto wallet on the device becomes readable to any malicious third-party app also installed.

Security researcher forcequitOS disclosed a proof of concept on November 8, 2026, crediting the discovery to researcher 0xjohnny. Apple shipped iOS 27.2.1 and iOS 26.7.3 on November 9, 2026. The official security notes for those updates did not explicitly confirm that worse_query had been fixed. Binance's advisory arrived the following day. No confirmed wallet thefts have been linked to worse_query as of this writing, but the window was open.

What the Sandbox Breach Actually Means

Apple's application sandbox isolates each installed app into its own container. App A cannot read App B's files. That isolation is what allows users to install a game, a social app, and a self-custodial wallet on the same device without trusting every developer equally. The worse_query vulnerability broke that model. A malicious app, once installed, could query the filesystem and access private keys, seed phrases, and login credentials stored by wallet applications.

This is not a remote exploit. An attacker cannot trigger worse_query over the network. The malicious app must already be installed on the target device. That lowers the probability of mass exploitation, but it does not eliminate the threat. Users install apps constantly. A convincing calculator, a fake VPN client, or a cloned productivity tool could have been weaponized to extract wallet credentials from devices running vulnerable iOS versions.

The timeline matters. The vulnerability was disclosed publicly on November 8. Apple pushed updates on November 9. Binance issued its warning on November 10. That leaves a narrow window during which anyone aware of the flaw could have deployed it before the public knew to update. Whether that window was exploited is unknowable without wallet movement data, and no such data has surfaced.

What This Means for Mobile-First Custody

For many crypto users, the phone has become the wallet. Self-custodial mobile wallets hold private keys on-device. Hardware wallets are safer, but less convenient. The tradeoff is obvious: mobility and ease of access in exchange for expanded attack surface. The worse_query flaw exposes the structural risk in that tradeoff. Operating system vulnerabilities become custody vulnerabilities.

This is not the first time iOS security has intersected with crypto custody risk. In 2022, researchers demonstrated clipboard snooping vulnerabilities that could intercept seed phrases during wallet recovery. In 2024, a Safari exploit allowed malicious websites to access local storage where some web-based wallets cached session keys. The worse_query flaw is different in that it bypassed the sandbox entirely, granting filesystem-level access to any app that requested it correctly.

The advisory from Binance specifically named private keys, seed phrases, and login credentials as exposed data types. That covers the full custody stack for most self-custodial wallets. If a malicious app accessed those files, it could reconstruct wallet control without the user ever signing a transaction or approving a connection. The funds would move silently, off-chain from the user's perspective, because the attacker would hold the same private key.

Wallets stored on centralized exchanges were not directly vulnerable. The worse_query flaw affected local files on iOS devices, not web-authenticated sessions or exchange-custodied balances. Users who hold funds exclusively on exchange accounts did not face filesystem exposure, though login credentials for those accounts could have been accessed if stored in iOS Keychain or within a vulnerable password manager app.

Apple's Silent Patch and What It Signals

Apple released iOS 27.2.1 and iOS 26.7.3 on November 9, 2026. The updates were available within 24 hours of the public proof of concept. The official security notes accompanying those releases did not mention worse_query by name. They did not describe a sandbox bypass. Apple's standard practice is to credit security researchers in its release notes when a disclosed vulnerability is patched. That credit did not appear in the November 9 notes.

Two possibilities exist. Either Apple patched the flaw without acknowledging it publicly, or the November 9 updates addressed other issues and worse_query remains unpatched. Binance's advisory assumes the former. It recommends that users update to iOS 27.2.1 or iOS 26.7.3 immediately. No follow-up statement from Apple has clarified whether worse_query was resolved.

This pattern is not new. Apple has historically been cautious about confirming zero-day vulnerabilities in public communications, particularly when those vulnerabilities affect financial security. The company's approach prioritizes rapid patching over detailed disclosure. That works when users update immediately. It fails when users delay updates or when the patch itself is incomplete.

What to Watch and What to Do

If worse_query was exploited in the wild, the evidence will appear on-chain. Wallet addresses that have been dormant or that follow predictable usage patterns will move funds unexpectedly. Those movements will not be accompanied by user-initiated transactions from known devices. The outbound transfers will originate from the same private key, but the behavior will be inconsistent with historical patterns.

Users running iOS 26.7.1, 27.0.1, or 27.2 should update to the latest available version immediately. After updating, rotate seed phrases for any self-custodial wallets that were active on the device during the vulnerable window. Move funds to a newly generated wallet on a clean device or a hardware wallet. Do not reuse the old seed phrase, even if no unauthorized activity is visible. The exposure was filesystem-level. If the seed was read, it was read silently.

Check installed apps. Any app installed between early November and the November 9 patch date should be reviewed. Apps from unknown developers, apps requesting unusual permissions, or apps that were sideloaded outside the App Store are higher risk. Uninstall anything that does not have a clear and verified provenance, as detailed in Binance's original advisory.

For users holding funds long-term, this incident reinforces the case for hardware wallets or air-gapped signing devices. Operating system vulnerabilities are not rare. They are a predictable feature of connected devices. The worse_query flaw is one of many. The next one will be different. The exposure remains structural.

The Takeaway

The worse_query vulnerability exposed private keys, seed phrases, and login credentials on iPhones running iOS 26.7.1, 27.0.1, and 27.2. Apple patched silently on November 9, 2026. Binance issued a public warning on November 10. No confirmed thefts have surfaced, but the window was open for at least 24 hours after public disclosure. If you held funds in a self-custodial wallet on a vulnerable iOS version, update your device and rotate your seed phrase. If you did not, watch for unexpected outbound transactions from addresses you control. The blockchain will show whether this was theoretical or live.

Frequently Asked Questions

What is the worse_query vulnerability?

Worse_query is a critical iOS security flaw affecting versions 26.7.1, 27.0.1, and 27.2 that allowed malicious apps to bypass Apple's application sandbox. This gave unauthorized apps filesystem access to private keys, seed phrases, and login credentials stored by cryptocurrency wallets on the same device. Security researcher forcequitOS disclosed a proof of concept on November 8, 2026, crediting researcher 0xjohnny with the discovery.

Did Apple fix the worse_query flaw?

Apple released iOS updates 27.2.1 and 26.7.3 on November 9, 2026, one day after the public proof of concept. However, the official security notes for those updates did not explicitly confirm that worse_query had been patched or mention the vulnerability by name. Binance's November 10 advisory assumes the flaw was resolved in those updates and recommends users update immediately.

Were any crypto wallets stolen using worse_query?

No confirmed wallet thefts have been publicly linked to the worse_query vulnerability as of November 10, 2026. The flaw required a malicious app to be installed on the target device, which lowers the probability of mass exploitation. However, the narrow window between public disclosure on November 8 and Apple's patch on November 9 could have been exploited. Any thefts would appear on-chain as unexpected wallet movements.

Should I rotate my seed phrase after updating iOS?

Yes, if you used a self-custodial wallet on an iPhone running iOS 26.7.1, 27.0.1, or 27.2 during the vulnerable period. Update to the latest iOS version, then move your funds to a newly generated wallet on a clean device or hardware wallet using a fresh seed phrase. Do not reuse the old seed phrase. The worse_query flaw provided filesystem-level access, so if your seed was read, it happened silently.

How does this affect funds held on centralized exchanges?

Funds held on centralized exchanges were not directly vulnerable to the worse_query flaw, because those balances are custodied by the exchange, not stored as private keys on your iOS device. However, login credentials for exchange accounts could have been exposed if they were stored in iOS Keychain or within a vulnerable password manager app installed on the device. Users should enable two-factor authentication and review recent account activity.