iPhone Sandbox Escape worse_query Puts Wallet Secrets in Question as Apple Stays Quiet

By Coinvote

Published November 12, 2026 - 11:23 UTC | 5 mins read

iPhone Sandbox Escape worse_query Puts Wallet Secrets in Question as Apple Stays Quiet

Binance has warned iPhone users that a public sandbox escape called worse_query could let a malicious app read wallet seed phrases stored by other apps. Outlets agree no thefts have been reported, but they differ on whether Apple's iOS 27.2.1 update closes the hole.

Binance tells iPhone users to purge untrusted apps

On Tuesday, Binance cautioned iPhone owners about an openly published iOS bug that might allow a rogue app to access other apps' stored files, among them wallet recovery phrases and private keys. Bitcoin Magazine, Decrypt and Cointelegraph all quoted the exchange's post on X. It named iOS 26.7.1, 27.0.1 and 27.2 as affected and called the problem "an iOS-level issue, not unique to Binance."

The exchange's advice was practical. It told users to remove any app that came from outside official channels, for example sideloaded or hand-signed packages, and to bring iOS and all installed apps up to the newest official releases. If a breach is suspected, Binance said, funds should go to a freshly made wallet on an uncompromised device, and every active login session should be reset.

A Binance spokesperson said to Cointelegraph that the basic risk of file access could extend to the whole iOS ecosystem. The spokesperson added that the exchange had identified no confirmed cases of attackers using the bug to reach wallets or steal funds. Decrypt also reported no confirmed thefts.

How worse_query breaks iOS app isolation

Every iOS app runs in a sandbox, a container meant to keep other apps away from its private files. A sandbox escape breaks that separation. According to Bitcoin Magazine, a researcher who posts as forcequitOS published worse_query on GitHub on Nov. 8 and presented it as the successor to an earlier exploit called bad_query. Cointelegraph described the disclosure as taking place on Sunday and said the researcher credited another researcher, 0xjohnny.

The project's README lists iOS 26.0 through 26.7.2 and iOS 27.2, which is a wider range than the versions Binance named, both Bitcoin Magazine and Decrypt noted. Bitcoin Magazine said the README lists reachable locations such as the data containers of other apps and folders shared within app groups.

The researcher calls the code a proof of concept for developers that "isn't useful by itself," and says it is not a jailbreak. Someone must first embed the code in an app for it to have any effect. Bitcoin Magazine reported that, one day after the code appeared, developer Christoph Kolbicz put out a file manager using worse_query; he said his testing was on iOS 27.0.1.

The timeline and figures that matter

The outlets agree on the broad sequence, with small differences in how they date individual steps.

Nov. 8: forcequitOS releases worse_query on GitHub, per Bitcoin Magazine.
Nov. 9: Apple ships iOS 27.2.1 and iOS 26.7.3, per Bitcoin Magazine, a day after the proof of concept appeared.
Nine: the number of vulnerabilities listed in the iOS 27.2.1 security notes, according to Decrypt.
Tuesday: Binance issues its warning, and SlowMist flags the issue earlier the same day, according to Cointelegraph.
$6.34 billion: the amount Binance lost in an Oct. 29 attack, according to Bitcoin Magazine.

Did Apple's update fix it? The accounts diverge

Bitcoin Magazine reported that the security notes for iOS 27.2.1 and iOS 26.7.3 cover AirPlay, Bluetooth pairing, brotli and other components. Neither set of notes mentions worse_query or a comparable sandbox escape. Decrypt reached the same reading of the notes, which it said include an App Intents authorization issue where an app may access sensitive user data, along with Bluetooth and iMessage flaws.

The outlets part ways on what follows. Cointelegraph said it is unclear whether either update fixes the flaw and that Apple had not answered its request for comment by publication. Decrypt reported that 23pds, the chief information security officer at SlowMist, urged users to move to iOS 27.2.1 and said the update would block the escape.

The Defiant, whose item is available only as a headline and summary, points the other way. Its headline says a researcher claims iOS 27.2.1 leaves a sandbox flaw open. The summary does not say who the researcher is or how the claim was checked, so the dispute remains unresolved.

Exposure depends on wallet storage and sideloading

As Bitcoin Magazine relayed it, SlowMist holds that worse_query cannot drain funds by itself. Danger appears only if a user installs and launches an untrusted IPA file, which then reads the containers of other apps. Even so, it counts only for wallets that leave mnemonics, keystores or cached WebView data unencrypted on the phone.

On that reading, wallets that avoid writing recovery phrases or keys to plain files are not exposed in the same way. Private keys on hardware wallets never sit on the phone. Installing software from outside the App Store is also a precondition.

The Defiant reported that SlowMist warned of possible exposure of plaintext wallet data. It also said Trust Wallet and Zerion stated that their iOS users are not affected. Neither claim is detailed further in the summary.

Why the warning lands amid wider custody worries

Bitcoin Magazine observed that Binance is itself still dealing with the aftermath of an attack on Oct. 29 that started with a bogus job interview. It also reported that some big holders have traded bitcoin held in self-custody for IBIT shares amid security concerns, and that Ledger said an organized criminal group put millions into targeting its customers.

Decrypt placed the story in a longer pattern of attacks on Apple devices. Earlier this year Google warned of iOS malware aimed at crypto apps on unpatched phones. Decrypt added that the Dutch national cyber agency reported in August that attackers abused a weakness in macOS Screen Sharing to install Monero mining software on Macs.

Open questions for holders and wallet teams

The first question is whether Apple will confirm that a patch covers worse_query, and for which iOS 26 and 27 builds. Its notes are silent so far, and Cointelegraph's request for comment was unanswered at publication.

The second is whether any theft is ever tied to the technique. Neither Binance nor the researcher has reported one. The third is how wallet teams store secrets on the device. Users can check whether their wallet keeps recovery data in plain files, whether any sideloaded apps remain installed, and whether iOS and every app is current.

Market snapshot

Asset	Price	24h	7d	Market cap
Bitcoin (BTC)	$73,306	-0.9%	-8.7%	$1.47 trillion
Monero (XMR)	$559	-3.2%	-12.6%	$10.53 billion

CoinGecko data as of 2026-11-12 (UTC).

FAQ

Which iPhones does worse_query affect?

Binance named iOS 26.7.1, 27.0.1 and 27.2. The researcher's README lists iOS 26.0 through 26.7.2 and iOS 27.2, according to Bitcoin Magazine and Decrypt.

Has anyone lost crypto to worse_query?

No theft has been reported. Binance told Cointelegraph it identified no confirmed cases, and Decrypt and Bitcoin Magazine reported none either.

Does iOS 27.2.1 fix the flaw?

It is disputed. Apple's notes do not mention worse_query, and Cointelegraph called the fix unclear. Decrypt reported that SlowMist's 23pds said the update blocks the escape, while The Defiant's headline cites a researcher saying the flaw stays open.