A dark iPhone lying on a matte black wooden table, with a thin crack of orange light running across the screen from one app icon to another app's folder; to the right, a closed grey metal hardware wallet, against a dim background with an amber glow.
Original AI-generated illustration.

Worse_query: an iOS Flaw Can Expose Seeds Stored by Hot Wallets

NodeWitness Team 9 min read

On November 10 Binance warned about worse_query, an iOS flaw that can let a malicious app read other apps’ files, including hot-wallet seeds and keys. No thefts have been confirmed. The version lists do not agree, and iOS 27.2.1 is not a proven close.

Binance posted the warning at 10:56 a.m. Madrid time on November 10 [1]. A vulnerability called worse_query, it said, affects iOS 26.7.1, 27.0.1 and 27.2 and lets malicious apps read local files from other apps, “putting seed phrases, private keys, and login credentials at risk across the entire ecosystem.” “This is an iOS-level issue, not unique to Binance,” the exchange wrote [1]. By 5:32 p.m. Madrid time the post had 1,950,643 views [1]. The advice was to delete apps installed from untrusted sources (sideloaded or manually signed packages), update iOS and every app through official channels, and, if a breach is suspected, move funds to a new wallet created on a clean device and reset active login sessions [1].

What the flaw actually does

This is not the same threat as DarkSword on the iPhone. DarkSword arrives through a booby-trapped page, with nothing to install. worse_query is a sandbox escape: a way around the wall that normally stops one iOS app from reading another app’s private files [2][3][4].

forcequitOS, working with 0xjohnny, published the proof of concept at 6:00 p.m. Madrid time on November 8 [2][3]. The README calls it a proof of concept for developers that “isn’t useful by itself,” the direct successor to an earlier escape named bad_query, and not a jailbreak — “and never will be” [3]. SlowMist’s threat-intel alert, posted at 7:46 a.m. Madrid time on November 10, makes the same distinction: it is a container sandbox escape, not a jailbreak, and the bug does not steal assets on its own [4]. The risk starts when someone installs an app from an untrusted source, such as a sideloaded IPA; if that app can use the escape, it can reach other apps’ data [4][5].

In plain terms, that means the folder where a wallet app stores its files on the phone. How the escape is built is not the point here. The result is: a malicious app on the same iPhone could read those files.

Which wallets sit in range

The wallets in range are the hot ones that keep a seed, private keys or a keystore in the app’s own local files, especially if that material is stored in plaintext. SlowMist and its CISO, 23pds, put it that way: if a wallet writes the recovery phrase, the keystore or a WebView cache to disk in the clear, a malicious app could read it [4][5]. Binance did not name a single wallet app, and neither did the researcher [1][3]. We will not invent a list.

A hardware wallet — a signing device used as intended — sits outside that reach. Spending keys never leave the device and are not copied into an iPhone app folder. A companion app may recieve public addresses or labels. It should not hold the seed. That is the same line we drew in our piece on the COLDCARD generator: the weak point is usually the copy someone left in the wrong place. A seed typed into Notes, photographed, or saved as a file on the phone would still be in reach, just as it is with DarkSword.

One thing is still open: whether an App Store app could use this technique. The public warnings focus on untrusted, sideloaded software. Nobody involved has confirmed that a store app can, and we will not treat that as settled either way.

The version lists do not agree

This is the part that should not be smoothed over. Binance names three builds: iOS 26.7.1, 27.0.1 and 27.2 [1]. The proof-of-concept README, and SlowMist’s alert, give a wider range: iOS 26.0 through 26.7.2, plus iOS 27.2 [3][4]. Binance’s three builds sit inside that range; a phone on an earlier iOS 26 release is not in the clear just because the exchange did not list it.

Version or range Who says so What that means now
iOS 26.7.1, 27.0.1 and 27.2 Binance, November 10, 10:56 a.m. Madrid [1] The three builds in the exchange’s warning
iOS 26.0–26.7.2 and 27.2 worse_query README and SlowMist’s alert [3][4] The wider range; it already includes Binance’s three
iOS 27.2.1, 26.7.3 and 18.7.12 Apple, November 9 [6][7][8] Security updates shipped that day
27.2.1 blocks worse_query 23pds (SlowMist CISO), X article at 10:24 a.m. Madrid [9] His claim; Apple’s notes do not name the flaw
27.2.1 and 27.3 beta 1 do not patch it forcequitOS, 1:05 p.m. Madrid [10] The proof-of-concept author; he will update the README when it is patched

Apple released iOS 27.2.1 and iOS 26.7.3 on November 9, the day after the code went up [6][7][8]. The 27.2.1 notes list nine fixes, including an App Intents authorization issue through which “an app may be able to access sensitive user data,” plus Bluetooth, iMessage and AirPlay flaws [6]. Neither those notes nor the 26.7.3 notes mention worse_query, its authors, or a sandbox escape [6][7]. Apple’s standard line is that it does not discuss a security issue untill it has investigated and a patch is available [6].

That same morning, at 10:24 a.m. Madrid time, 23pds wrote that moving to 27.2.1 would also “block” the worse_query escape, along with help against DarkSword and a malicious-PDF bug [9]. Three hours later forcequitOS was blunt: “worse_query is not patched in iOS 27.2.1 and 27.3 beta 1. I’ll update version support on the readme when it’s patched” [10]. At 2:46 p.m., 23pds quoted that post and wrote that there was an error, that it was a sandbox matter, and that updating was still the first step [11].

With those three statements on the table, 27.2.1 cannot be sold as the minimum build that closes this flaw. Installing it is still worthwhile for the other fixes Apple did document. What does not depend on the argument is refusing apps from untrusted sources, and keeping the seed off the phone.

Decrypt has a clear account of the warning and, like us as of this afternoon, reports no confirmed thefts [12]. A Binance spokesperson told Cointelegraph the exchange had not identified any case in which attackers used the bug to reach a cryptocurrency wallet or steal funds [13].

A short checklist

  1. Check the build under Settings > General > About, and update through Apple’s official path (Settings > General > Software Update). As of November 10, the current releases are iOS 27.2.1, or 26.7.3 and 18.7.12 on the older lines [8]. Treat that as hygiene, not as a confirmed close of worse_query.
  2. Delete apps installed outside the official store: sideloaded packages, apps you signed yourself, or anything from a source you do not control [1][4].
  3. If a phone that holds a hot wallet also had an untrusted app on it, treat the seed as compromised: a new wallet on a clean device, move the funds, and reset login sessions [1][4].
  4. If you can, keep the seed only on a hardware wallet and on the paper backup. The phone can watch; it should not sign.

We will update this piece when Apple names the flaw, when the researcher updates the README, or if a confirmed theft appears.

Sources

Source type in brackets. Times are given in UTC when the source uses UTC; in the body they are converted to Madrid time (UTC+1). All consulted on the afternoon of November 10, 2026.

  1. Binance, post on X, 09:56:34 UTC on November 10, 2026 (10:56 a.m. Madrid). worse_query on iOS 26.7.1, 27.0.1 and 27.2; iOS-level issue; advice to delete untrusted apps, update, and move funds if a breach is suspected. 1,950,643 views at 16:32 UTC (5:32 p.m. Madrid). (Primary, exchange warning)
  2. forcequitOS, post on X, 17:00:25 UTC on November 8, 2026 (6:00 p.m. Madrid). Announcement of worse_query, with 0xjohnny, as a zero-day sandbox escape for iOS 26 and 27. (Primary, researcher)
  3. forcequitOS, worse_query repository, created November 8, 2026. Range iOS 26.0–26.7.2 and 27.2; proof of concept for developers; successor to bad_query; “not relevant to a jailbreak.” (Primary, code and README)
  4. SlowMist, threat-intel alert on X, 06:46:21 UTC on November 10, 2026 (7:46 a.m. Madrid). Container sandbox escape, not a jailbreak; range 26.0–26.7.2 and 27.2; risk starts with an untrusted IPA; do not store secrets in plaintext. (Primary, security firm)
  5. 23pds (SlowMist CISO), post on X, 02:47:35 UTC on November 10, 2026 (3:47 a.m. Madrid). The bug does not steal on its own; the trigger is an unknown IPA; risk if the mnemonic, keystore or WebView cache sits on disk in plaintext. (Primary, CISO)
  6. Apple, About the security content of iOS 27.2.1 and iPadOS 27.2.1, published November 9, 2026. Nine fixes; does not name worse_query. (Primary, official notes)
  7. Apple, About the security content of iOS 26.7.3 and iPadOS 26.7.3, published November 9, 2026. Also does not name worse_query. (Primary, official notes)
  8. Apple, Apple security releases, consulted November 10, 2026. iOS 27.2.1, 26.7.3 and 18.7.12, all dated November 9; current iOS is 27.2.1. (Primary, official log)
  9. 23pds, X article “苹果发布重要更新 务必更新”, 09:24:21 UTC on November 10, 2026 (10:24 a.m. Madrid). Claims 27.2.1 would also block the worse_query escape. (Primary, CISO)
  10. forcequitOS, post on X, 12:05:20 UTC on November 10, 2026 (1:05 p.m. Madrid). worse_query is not patched in iOS 27.2.1 or 27.3 beta 1. (Primary, researcher)
  11. 23pds, follow-up on X, 13:46:57 UTC on November 10, 2026 (2:46 p.m. Madrid). Quotes forcequitOS and writes that there was an error; still recommends updating first. (Primary, CISO)
  12. Decrypt, Binance Warns of Apple iOS Flaw That Could Expose iPhone Users' Private Keys, November 10, 2026. Account of the warning; no confirmed thefts; reports 23pds’s earlier claim about 27.2.1. (Secondary, press)
  13. Cointelegraph, Binance Warns iOS Flaw Could Expose Crypto Wallet Keys, November 10, 2026. Binance spokesperson: no confirmed cases of wallet access or stolen funds with this bug. (Secondary, press)

More in Privacy and self-custody

See all 34 articles in Privacy and self-custody →

Last updated: November 10, 2026