Emerging ThreatsMalware & Ransomware

Binance Warns of iOS Flaw That Exposes Crypto Wallet Keys

Analyst 207||Source: TheHackerNews
iPhone on a neutral surface with a blurred background and a partially visible laptop nearby.

"[The code] isn't useful by itself," the researcher who goes by forcequit wrote — a technical understatement that still leaves a high-stakes practical risk for some iPhone users, according to a security advisory posted today by the cryptocurrency exchange Binance.

What the escape does: worse_query's reach

The proof-of-concept released on GitHub, called worse_query, can let an app read every other app's data container on iPhones running certain versions of iOS, the researcher says. On iOS 27, the code can also reach some system folders. The researcher published the escape on Sunday, a day before Apple's updates for iOS 26 and 27 were released.

According to the published code and the exchange's advisory, worse_query operates without a jailbreak or a kernel exploit; it requires that an app set up an App Group container to exercise the capability. The researcher described the release as intended for developers and added that he had not planned to release it early, writing on X that "Apple was stalling on responding to me and people started larping with it on here."

WQ Files, sideloading tools, and the practical path to exposure

Developers have used worse_query to build apps that users can install. One notable example is WQ Files, a file manager built by Christoph Kolbicz that uses worse_query and — according to the WQ Files release notes — can reach other apps' data without a jailbreak. The notes say WQ Files can edit, delete and clear that data.

WQ Files installs via sideloading tools such as AltStore and SideStore. The exchange's advisory calls out apps installed from untrusted sources — sideloaded or manually signed apps — as a particular risk because those tools automatically create the App Group the exploit needs when used with an Apple ID. The published material stops short of asserting whether an app distributed through the App Store could leverage worse_query; no one involved has said that an App Store app can do so.

Apple's recent updates and the absence of a confirmed fix

Apple released updates yesterday: iOS 27.2.1 and iOS 26.7.3. According to Apple's security notes, those updates fixed two iMessage flaws and several Bluetooth bugs. The security notes for iOS 27.2.1 and iOS 26.7.3 do not mention worse_query or any sandbox-escape issues.

Apple's public guidance, quoted in the security notes, is that "Apple does not disclose, discuss, or confirm security issues until it has investigated and a patch or release is available." As of the exchange's advisory, no fix for the sandbox escape has been confirmed.

Binance's advisory: immediate guidance for users

Binance warned that worse_query "puts seed phrases, private keys, and login credentials at risk of exposure to malicious apps." The exchange said it had not seen any reported attacks or thefts tied to the escape, and that the researcher and the exchange had not reported any thefts.

Binance told users to delete apps installed from untrusted sources, such as sideloaded or manually signed apps, and to update iOS and all their apps. For anyone who suspects a breach, Binance advised moving funds to a new wallet created on a clean device and resetting all active login sessions.

The exchange did not name any specific wallet app as exposed; neither the researcher nor the developers of apps built on worse_query named one.

What this means for technologists and security teams, crypto users, and app developers

  • Technologists and security teams: Monitor installed devices for sideloaded or manually signed apps and audit App Group configurations. Because worse_query can reach apps' data containers and, on iOS 27, some system folders, teams should treat any untrusted app with App Group access as potentially dangerous.
  • Crypto users and custodial customers: Follow Binance's guidance — delete untrusted sideloaded apps, update iOS and apps, and, if a compromise is suspected, move funds to a new wallet created on a device that has never run the suspected apps and reset active sessions.
  • App developers and sideloading-tool authors: Note that some projects' documentation already lists compatibility. The developers of Erosion added iOS 27.2.1 to a README this week with the note "pretty sure 27.2.1 is supported"; no one listed iOS 26.7.3. Developers who build on worse_query or distribute tools that create App Group containers should reassess the security model and user guidance for sideloading workflows.

Two key facts remain: the code is public and usable by others, and as of the exchange's warning and Apple's recent security notes, no confirmed fix has been published. The immediate practical takeaway in the record is concrete and narrow — remove apps from untrusted sources, update software, and follow Binance's remediation steps if you suspect a breach — while the broader remediation timeline depends on whether and when Apple or third parties publish a definitive patch or mitigation.

Original story: The Hacker News — Binance Warns of iOS Sandbox Escape

Emerging ThreatsMobile SecurityCryptocurrency ExchangeCrypto Wallet SecurityBinanceIos Security FlawWallet Key ExposureApple Ios Vulnerability
Related Intelligence

Continue Reading

Laptop on a clean surface shows a blurred admin console screen with a car in the background.

Researchers Expose Car Brands' Admin Console Flaw

Security researchers just uncovered a shocking vulnerability in two car brands' admin consoles, allowing them to remotely unlock and start a test car by exploiting a ridiculously simple flaw: a default password that hadn't been changed. This startling discovery highlights the importance of updating even the most basic security measures.

Analyst 207
Government building interior with server room door ajar, hinting at cyber infrastructure.

Turla Hackers Deploy Cereal Malware to Infiltrate Government Exchange Servers

Meet the sneaky Cereal malware, a stealthy cyber espionage tool deployed by Russia-aligned hackers Turla to secretly harvest emails from government Exchange servers. This covert operation has already hit government targets in Kazakhstan and Romania, with a focus on sensitive NATO and EU communications.

Analyst 207
Concerned students and faculty in a Vanderbilt University hallway with an open laptop in the foreground.

Vanderbilt University Cyber Incident Disrupts Systems, Exposes Sensitive Data

Vanderbilt University has taken swift action to contain a cyber incident, urging all community members to shut down university devices and disconnect from campus WiFi to prevent further damage and protect sensitive data. If you notice anything unusual on your devices, take immediate action and report it to ensure your safety and security.

Analyst 207
Server room with rows of racks and equipment, some showing signs of tampering.

Turla hackers deploy Cereal malware to infiltrate govt Exchange servers

ESET researchers have uncovered a sneaky new tactic by the notorious Turla hacking group, who are using a modular spying platform called Cereal to infiltrate government Exchange servers and intercept sensitive emails. The malware has already been detected in compromised government organizations in Kazakhstan and Romania.

Analyst 207