Binance Warns of iOS Sandbox Escape That Could Expose Crypto Wallet Keys, No Fix Confirmed
An iOS sandbox escape published on GitHub lets an app read other apps' files on iPhones running iOS 26 and 27, and that puts seed phrases, private keys, and login credentials at risk of exposure to malicious apps, Binance warned today.
An iOS sandbox escape published on GitHub lets an app read other apps' files on iPhones running iOS 26 and 27, and that puts seed phrases, private keys, and login credentials at risk of exposure to malicious apps, Binance warned today.
Apple's updates for iOS 26 and 27, released yesterday, do not list a fix.
A researcher who goes by forcequit, in collaboration with 0xjohnny, released the escape, called worse_query, on Sunday, a day before those updates came out.
Neither the exchange nor the researcher reported any attacks or thefts involving it.
For anyone who suspects a breach, the exchange's security warning advises moving funds to a new wallet created on a clean device and resetting all active login sessions.
The exchange told users to delete apps installed from untrusted sources, such as sideloaded or manually signed apps, and to update iOS and all their apps.
The researcher's proof-of-concept code can reach every app's data container on an iPhone, and some system folders on iOS 27.
Other developers have built apps on it that people can install, and it reaches other apps' data without a jailbreak or a kernel exploit, and it can edit, delete and clear that data.
One of them is WQ Files, a file manager that developer Christoph Kolbicz built on worse_query.
WQ Files installs via sideloading tools such as AltStore and SideStore, which automatically create the App Group it needs when used with an Apple ID.
The three versions in the exchange's warning are the ones listed as tested in the WQ Files release notes, and yesterday's updates, iOS 27.2.1 and iOS 26.7.3, fixed two iMessage flaws and several Bluetooth bugs.
Apple does not disclose, discuss, or confirm security issues until it has investigated and a patch or release is available, the notes say.
What happened
An iOS sandbox escape published on GitHub lets an app read other apps' files on iPhones running iOS 26 and 27, and that puts seed phrases, private keys, and login credentials at risk of exposure to malicious apps, Binance warned today.
Apple's updates for iOS 26 and 27, released yesterday, do not list a fix.
What changed
A researcher who goes by forcequit, in collaboration with 0xjohnny, released the escape, called worse_query, on Sunday, a day before those updates came out.
Neither the exchange nor the researcher reported any attacks or thefts involving it.
For anyone who suspects a breach, the exchange's security warning advises moving funds to a new wallet created on a clean device and resetting all active login sessions.
Who is affected
The exchange told users to delete apps installed from untrusted sources, such as sideloaded or manually signed apps, and to update iOS and all their apps.
The researcher's proof-of-concept code can reach every app's data container on an iPhone, and some system folders on iOS 27.
Why it matters
Other developers have built apps on it that people can install, and it reaches other apps' data without a jailbreak or a kernel exploit, and it can edit, delete and clear that data.
Technical details
One of them is WQ Files, a file manager that developer Christoph Kolbicz built on worse_query.
WQ Files installs via sideloading tools such as AltStore and SideStore, which automatically create the App Group it needs when used with an Apple ID.
Response
The three versions in the exchange's warning are the ones listed as tested in the WQ Files release notes, and yesterday's updates, iOS 27.2.1 and iOS 26.7.3, fixed two iMessage flaws and several Bluetooth bugs.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.