Binance: iOS 26 and 27 can leak wallet seeds

Binance told customers on Tuesday, November 10, 2026, that a flaw in iOS can let one app read private files that belong to another. The exchange named iOS 26.7.1, 27.0.1, and 27.2. The files at stake include cryptocurrency seed phrases, private keys, and saved login credentials. Binance described it as an operating-system issue, with reach beyond the Binance app itself.

Apple shipped iOS 27.2.1 and iOS 26.7.3 on November 9. Those security notes list other fixes and do not name this sandbox failure, so a phone that updated yesterday is still an open question. A public proof of concept, released Sunday by a researcher who posts as forcequit, working with 0xjohnny, is called worse_query. Binance and the researcher have not reported thefts that use it.

What sits in the app container

iOS keeps each app’s data in its own container. worse_query is a break in that separation on the builds Binance listed. A malicious app on the phone can read files another app stored. For a wallet, that file is often the recovery phrase or the key that spends the coins. For a password manager or a mail client, it is the session that signs the owner in somewhere else.

Binance did not name a wallet product as confirmed exposed. The warning covers any app that stores a secret on an affected iPhone. The installs the exchange told people to remove are sideloaded apps and packages signed by hand. No public statement has shown that an App Store download can perform the same read.

What to do while the fix is unconfirmed

Install the newest iOS update, then read the build string the phone reports. Treat 27.2.1 and 26.7.3 as unconfirmed until Apple’s notes say this sandbox failure is closed. Delete apps that arrived from outside the App Store. Update the wallet and the exchange app from the store after that.

Anyone who ran an untrusted app on 26.7.1, 27.0.1, or 27.2 should assume a seed phrase that lived on that phone can already have been copied. Create a new wallet on a device that never ran the untrusted app, move the funds, and reset active login sessions at the exchange. Removing the suspicious app leaves a copied key able to spend.

On managed phones, block sideloading. Inventory devices that still hold recovery phrases, authenticator data, or corporate tokens and still report one of the three builds. The version string is the record that matters. Until Apple publishes a fix, the control is which apps are allowed to run beside the wallet.

This briefing relies on public reporting by BleepingComputer and on Binance’s customer warning. It does not include exploit procedures or proof-of-concept detail.