Binance issued an iPhone warning on Nov. 10 about worse_query, an iOS flaw that could let malicious apps reach files tied to other apps. For iPhone users who keep crypto wallets or logins on the same device, the risk is not the headline itself but what a rogue app might find if it lands on an affected phone.
Binance said those files could include crypto wallet recovery phrases, private keys and login credentials. The exchange also said the issue is an iOS-level problem, not one unique to its app, and that roughly one in four active smartphones worldwide is an iPhone.
Binance and the Nov. 10 warning
The warning landed days after Binance suffered a cyberattack on Oct. 29 that affected approximately $6.34 billion in digital assets. Through compromised employee computers, attackers reached Binance's internal wallet-signing service and initiated unauthorized transactions.
That earlier breach makes this advisory harder to dismiss as routine security theater. Binance is telling users to remove applications downloaded from untrusted sources and install official iOS and app updates, which is the basic filter that cuts off the easiest path for a malicious app to get a foothold.
Apple's Nov. 9 updates
Apple released iOS 27.2.1 and iOS 26.7.3 on Nov. 9. The release notes do not confirm whether either update fixes worse_query, so users cannot assume the new versions close this specific hole just because they are current.
The published proof of concept also needs extra configuration to work, which suggests the flaw is not a one-step attack in every case. Even so, Binance said the reachable range appears broad, and no specific wallet application has been identified as exposed.
What affected users should do
Binance told users who think a device has been compromised to create new wallets on clean devices, move their assets and reset active login sessions. That sequence matters because it treats the phone as potentially tainted before anything else on it can be trusted again.
Neither Binance nor the researcher has reported attacks or thefts involving worse_query yet. The open question is whether Apple's Nov. 9 updates actually patch the flaw, because that determines whether the safer move is routine updating or full wallet migration first.
