Binance Warns Three iOS Versions Put Wallet Credentials at Risk

By Amara Osei

Less than two weeks after hackers stole $6.3 billion worth of cryptocurrency from Binance, the exchange warned that three iOS versions could expose crypto wallet credentials held in iPhone apps.

Binance issued the alert on Tuesday through X and named the vulnerability “worse_query.” According to the exchange, malicious third-party apps could exploit the flaw to read files from other apps.

“A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem,” Binance wrote on X.

What does the iOS vulnerability expose?

The company said the affected releases are iOS 26.7.1, iOS 27.0.1 and iOS 27.2. Seed phrases, private keys and login credentials are the sensitive assets Binance placed at risk.

Binance said the flaw was not specific to its app. It could affect any app that stores sensitive information on an iPhone running one of the three affected iOS versions.

That scope makes the disclosure broader than a Binance wallet alert. The mechanism Binance described is app-to-app file reading, which can let malicious apps access data held by other apps.

How does the warning fit the $6.3 billion heist?

The iOS alert followed less than two weeks after the $6.3 billion theft from Binance. The FBI later linked the hackers responsible for that theft to North Korea.

Binance released its own report on the heist last week. It said the incident was “not a single isolated breach or a simple phishing incident.”

The exchange characterized the theft as the culmination of months of effort and various hacking techniques. One technique was elaborate social engineering, which entailed conducting fake job interviews with an unsuspecting Binance engineer.

The report focused on the methods behind the exchange breach. Tuesday’s X warning focused instead on a file-reading mechanism that lets malicious apps access data held by other apps. The chronology is direct: Binance reported the heist last week, then issued the iOS alert on Tuesday.

What did Binance tell iPhone users to do?

Binance recommended three actions for iPhone users:

• Delete any untrusted apps.
• Update their software.
• Transfer Binance funds to a new wallet on a clean device if they suspect a breach.

The transfer instruction applies specifically to Binance funds and only when a user suspects a breach. The broader delete-and-update advice applies to all users of the three affected iOS versions, consistent with Binance’s statement that the flaw is not specific to its app.

Together, the recommendations cover both prevention and a response to suspected compromise. Deleting untrusted apps addresses the malicious-app vector. Updating software and moving Binance funds to a clean device responds to the broader risk Binance described.

What remains at risk?

Binance framed the flaw as potential exposure across the iPhone app ecosystem. The named assets were seed phrases, private keys and login credentials that apps may store locally.

The exchange’s use of “across the entire ecosystem” widened the concern beyond crypto wallets. Any app holding sensitive information on the three affected versions falls within Binance’s description, according to the exchange.

After the $6.3 billion theft, Binance said the breach required months of work and multiple techniques. That sequence makes locally stored crypto credentials a timely concern for users weighing the three affected versions.

The practical test for users of the three affected versions is straightforward: update software, remove untrusted apps and isolate Binance funds if compromise is suspected. Under Binance’s assessment, the exposure path remains specific: a malicious third-party app reads local files from another app, potentially exposing seed phrases, private keys or login credentials.