Binance Cautions that iPhone Sandbox Vulnerability Puts Wallet Keys at Risk; Apple Has Not Yet Provided a Solution

Binance has issued a cautionary statement to iPhone users regarding a publicly disclosed iOS sandbox escape that enables one application to access the files of others.

This vulnerability, the exchange claims, jeopardizes the integrity of crypto wallet seed phrases, private keys, and login credentials across the ecosystem.

The vulnerability, labeled as worse_query, was made public on GitHub by a security researcher using the pseudonym forcequit.

In its advisory, Binance indicated that this exploit has been documented in versions iOS 26.7.1, 27.0.1, and 27.2, emphasizing that the root of the issue is found within Apple’s operating system rather than in the wallet software provided by Binance.

“Seed phrases, private keys, and login credentials may be compromised across the entire ecosystem,” stated the exchange, pointing out that the flaw is not exclusive to its platform.

On Monday, Apple released iOS 27.2.1 and iOS 26.7.3. However, the accompanying security notes failed to reference worse_query or any related sandbox problems.

It remains the standard protocol of the company not to disclose, discuss, or confirm security vulnerabilities until a thorough investigation has been conducted and a patch developed.

This practice leaves users in uncertainty as to whether the latest updates effectively mitigate the risk.

Mechanism of the Escape

This exploit targets the application’s sandbox—the security framework designed to keep the private files of each app confined, distinct from the data of other applications on the device.

Generally, an application is unable to access the local data of another app. Nonetheless, as per the proof-of-concept code provided by the researcher, worse_query can infiltrate the data containers of all applications on an iPhone, along with various system folders on iOS 27, provided the offending application establishes an App Group container.

The researcher characterizes the code as a development tool, noting that it “isn’t functional on its own.” Nevertheless, other developers have already begun to build upon this foundation.

For instance, developer Christoph Kolbicz has utilized the exploit to create WQ Files, a file manager that can read, edit, delete, and clear data belonging to other applications without requiring a jailbreak or kernel exploit.

WQ Files can be installed via sideloading utilities like AltStore and SideStore, which automatically create the necessary App Group when linked to an Apple ID.

To date, none of the involved parties—the exchange, the researcher, nor the developers leveraging the code—have identified a specific wallet application at risk, and it remains unclear whether an app distributed through the App Store could exploit this vulnerability.

The three iOS versions cited in Binance’s advisory correspond with those noted in the WQ Files release documentation.

The researcher mentions a broader scope, encompassing iOS versions 26.0 through 26.7.2 and iOS 27.2. Only one of the derived projects acknowledges iOS 27.2.1 as supported—with the caveat that “pretty sure 27.2.1 is supported”—while none list iOS 26.7.3 as compatible.

Note: Apple’s Monday updates addressed two iMessage vulnerabilities and multiple Bluetooth bugs, as outlined in the security notes.

Timing and Communication Challenges

This exploit became public knowledge just one day before Apple’s scheduled updates were released. In a response on X, the researcher clarified that the premature disclosure was not his intention, stating, “Apple was stalling on responding to me, and people started larping with it on here.”

Binance advises users to uninstall any applications obtained from untrustworthy sources, particularly those sideloaded or manually signed as IPA files.

Users are urged to ensure their iOS and every application is updated to the latest official versions. Those who suspect a security compromise should create a new wallet on an uncontaminated device, transfer assets, and reset all active login sessions.

Comments from SlowMist’s security chief emphasize the technical ramifications of this flaw, highlighting that it undermines the presumed safeguard of isolation between app containers.

This concern transcends the cryptocurrency realm; any application that retains passwords, authentication data, or personal files in readily accessible locales is vulnerable to the same class of exploits, which is particularly pertinent for devices utilized for both banking and digital asset transactions.

A Convergence of Mobile Threats

This warning emerges amidst a series of iOS-related security alerts targeting cryptocurrency users. In September, Binance flagged the FomoPeek app, versions 1.1 and 1.2, which reportedly contained malicious code designed to exploit iOS vulnerabilities and gain elevated privileges, with the potential for accessing recovery phrases, private keys, and credentials.

Recently, CertiK has brought attention to a new iteration of DarkSword, an iOS exploit kit aimed at crypto wallets on unpatched iPhones.

This exploit can initiate simply by visiting a malicious site in Safari—no wallet connection or signature required.

While these incidents employ diverse attack methodologies, they collectively illuminate a systemic issue for self-custody: protecting a recovery phrase necessitates safeguarding every location where it may be stored.

A wallet that retains plaintext seed data in a local file is only as secure as the isolation provisions of the operating system, and those guarantees are precisely what worse_query calls into question.

For investors, the primary exposure remains among users who sideload applications or maintain keys within software wallets on iPhones.

Conversely, hardware wallets and air-gapped storage are insulated from the vulnerabilities described in the advisory.

As it stands, the market response appears muted—no thefts have been directly attributed to this flaw—yet the absence of a verified patch prolongs the duration of risk until Apple addresses the matter or publishes corresponding documentation.

Apple has not publicly acknowledged worse_query. Consequently, the exchange’s advisory serves as the most comprehensive public guidance available, placing the onus on users to assess what applications reside on their devices rather than awaiting confirmation of an official remedy.

Source link: Finance.biggo.com.