Binance warns of iOS flaw that could leak crypto wallet secrets

Binance has a newly disclosed security flaw that anyone running it should know about.

This requires local or already-authenticated access to reach.

Binance is warning about a vulnerability in Apple’s iOS 26.7.1, 27.0.1, and 27.2 that could allow third-party apps to read private files stored by other apps, including cryptocurrency seed phrases, secret keys, and login credentials.

At this time, no cryptocurrency losses have been confirmed, but Binance urges users to install the update immediately as a precaution.

Where compromise is suspected, Binance advises users to transfer funds to a new wallet created on a clean device and reset all active login sessions.

worse_query is a publicly disclosed iOS sandbox escape technique that allows an application to cross security boundaries and access the storage of other applications.

Anyone running Binance for iOS and other apps is exposed, specifically wherever Binance is actually deployed rather than just licensed or installed somewhere unused.

The company recommends that users delete any unnecessary and untrusted apps and apply the latest versions for iOS and other apps.

WQ Files has been confirmed to work on iOS 26.7.1, 27.0.1, and 27.2, the same versions that Binance warned about.

What an attacker actually gains: the advisory describes a real security impact once the vulnerable path is reached.

The crypto exchange clarifies that the issue is at the iOS level and does not impact only the Binance app.

The tool must be installed on an iPhone for the attack to work, but an attacker could distribute it through untrusted sources as a sideloaded app, bypassing Apple's App Store.

This is tracked as CVE-2026-113963 -- use that identifier when checking vendor guidance or scanner results.

The affected versions are for iOS and other apps, so that's the range to check against your own deployment.

Yesterday, a proof-of-concept exploit has been published that uses a tool called WQ Files to perform attacks relying on the technique.

Apple on November 9 released iOS security updates (iOS 27.2.1, 26.7.3, and 18.7.12) that address nine flaws.

One of the fixed vulnerabilities, tracked as CVE-2026-113963, could allow an app to access sensitive user data.

BleepingComputer has contacted Apple for clarifications and a request for comment, and we will add an update once we receive more details.

Confirm whether Binance for iOS and other apps is present anywhere in your asset and software inventory.

No exploitation has been reported yet, but that status can change, so keep watching vendor guidance while you remediate.

FBI agent stole $2.5 million in crypto from hackers under investigation Hackers use n-day exploits in zero-click attacks on iOS, Android devices