Binance issued a security advisory on November 10 warning that a vulnerability identified as worse_query affects iOS 26.7.1, 27.0.1, and 27.2. The flaw compromises seed phrases, private keys, and login credentials, extending the risk across all applications on affected devices.
The exchange emphasized that the issue is not exclusive to Binance but a generalized vulnerability in Apple's environment that weakens local storage protections for digital assets.
Binance's warning follows a proof-of-concept published two days earlier. A security researcher operating under the handle forcequitOS released worse_query on November 8, 2026. The technique reportedly impacts iOS versions 26.0 through 26.7.2, iOS 27.2, and the iOS 27.3 beta.
A Container Escape, Not a Jailbreak
SlowMist's Chief Information Security Officer, 23pds, posted a warning on November 10 clarifying that worse_query is a container sandbox escape, not a jailbreak, and may break data isolation between applications.
Apple's security documentation says third-party apps are normally isolated in sandboxes designed to prevent them from gathering or modifying other apps' information. Worse_query targets that separation: its README lists access to app-data and shared app-group containers, plus certain system containers on iOS 27.
The vulnerability cannot automatically steal assets on its own. Once users install and run untrusted IPAs, malicious applications may access the containers of other applications. If wallets store mnemonic phrases, keystores, or WebView caches in plaintext locally, the relevant data risks being read.
Worse_query is the direct successor to bad_query, an earlier sandbox escape that targeted iOS 26.0 through 26.6.1 and iOS 27.0 beta 4.
Apple's Patch Timing Raises Questions
Apple released iOS 27.2.1 on November 9, 2026, one day after the worse_query proof-of-concept appeared on GitHub. The update fixes nine security vulnerabilities affecting iMessage, Bluetooth pairing, AirPlay, App Intents, and the brotli compression library.
SlowMist's 23pds stated that iOS 27.2.1 "prevents DarkSword attacks, blocks memory corruption caused by malicious PDF handling via CVE-2026-112611, and stops the worse_query sandbox escape vulnerability."
But Apple's official documentation tells a different story. Apple released iOS 27.2.1 and iOS 26.7.3 on November 9. Neither security advisory identifies worse_query or confirms a fix for this proof of concept; the availability of those updates does not establish that they block it.
The discrepancy leaves users in an awkward position. SlowMist says the update stops the attack. Apple's security notes do not mention it. Apple does not say any of these flaws were used in real attacks.
What to Do
Binance advised users to delete any apps installed from untrusted sources, such as sideloaded or manually signed IPAs. The exchange recommended updating iOS and all apps to their latest versions. Users who suspect a breach should transfer funds to a new wallet created on a clean device and reset all active login sessions.
CZ, the Binance founder, said wallet software cannot update a user's operating system. He framed self-custody as a personal responsibility, saying wallet software cannot maintain the device's operating system for its owner.
The timing is inconvenient for Binance, which is still recovering from an unrelated $6.34 billion security breach disclosed on October 29. Binance committed to covering affected customer balances rather than transferring financial losses to users. In its November 3 update, Binance reported freezing approximately $2.85 billion in stolen assets and replenishing 98% of affected tokens.
The developer of worse_query says the technique is not relevant to a jailbreak and never will be. That may be true, but it is relevant to anyone storing secrets in plaintext on an iPhone running iOS 26 or 27. Apple has also released iOS 26.7.3 and iOS 18.7.12 updates for devices not running iOS 27.
