Binance Tells iPhone Users to Delete Sideloaded Apps Over iOS Exploit

Brief

By Dextape Desk · November 10, 2026

Binance warned iPhone users on Tuesday that a flaw called worse_query lets malicious apps read files belonging to other apps, a route to wallet secrets and logins. The exchange flagged builds 26.7.1, 27.0.1 and 27.2 as vulnerable. Co-founder Yi He reposted the notice. Advice includes removing apps from untrusted sources, updating iOS and apps, and, for suspected breaches, moving funds to a new wallet on a clean device and signing out of all sessions. The bug traces to a public GitHub proof-of-concept by a developer called forcequitOS, described as a sandbox escape for iOS 26.0 through 26.7.2 and 27.2. The developer said the code is not useful alone and needs an App Group container. Apple's iOS 27.2.1 release on Nov. 9 lists nine fixes, none naming worse_query. Binance's hot wallets were drained of about $6.3 billion less than two weeks earlier.

Why it matters: Because the flaw can expose files held by other apps, the warning bears directly on iPhone users who keep crypto wallets on their phones.

Mentioned: Binance

Summary by Dextape, based on reporting by Unchained. Machine-written from Unchained’s report and checked against it · How Dextape writes