When Binance warned iPhone users Tuesday that a publicly released iOS flaw could let malicious apps read seed phrases and private keys, the exchange was sounding an alarm about a serious problem. The vulnerability affecting iOS 26.7.1, 27.0.1, and 27.2 represents exactly the kind of threat that should prompt swift, transparent action from device makers. Yet Apple's response—or lack thereof—raises uncomfortable questions about how seriously the company takes cryptocurrency security.
The flaw itself is no minor issue. Researcher forcequitOS released worse_query on GitHub on November 8, describing it as "a zero-day sandbox escape for iOS 26 and 27, again." On iOS, each app is supposed to live in its own container that other apps cannot read. This exploit breaks that fundamental security model. Within a day, developer Christoph Kolbicz had already weaponized it, publishing a file manager built on worse_query that lets users browse and edit app data on iOS 27 without jailbreaking, tested on iOS 27.0.1. The proof of concept exists, it works, and malicious actors are already building on it.
Here's where Apple's response becomes troubling. The company shipped iOS 27.2.1 and iOS 26.7.3 on November 9, just one day after the proof of concept went public. Yet Apple's security notes for these updates list fixes for AirPlay, Bluetooth pairing, brotli and other components—but they neither name worse_query nor describe a sandbox escape of this kind. That leaves it unclear whether the latest iOS builds actually block the technique. Users are left in the dark about whether updating protects them or not.
SlowMist, the blockchain security firm, offers some reassurance: the risk comes specifically when a user installs and runs an untrusted IPA that reads other apps' containers, and only if a wallet stores mnemonic phrases or keystores in plain text on the device. Hardware wallets keep private keys off the phone entirely. But not all wallet users take these precautions, and not all wallet developers implement proper storage. For casual iPhone users holding bitcoin in a mobile wallet, Binance's advice amounts to basic hygiene: stay on official iOS releases, skip sideloaded apps, and move funds if a device may be compromised.
The timing of this disclosure compounds the problem. Binance is still recovering from its own October 29 breach that cost the exchange $6.34 billion. Security worries have already pushed some large holders to abandon self-custody. When Apple fails to clearly communicate whether its emergency patches address a known sandbox escape affecting seed phrases and private keys, the company undermines confidence in the entire iPhone ecosystem for crypto storage. Cryptocurrency users deserve clarity, not ambiguity.