Binance Cautions iPhone Users on iOS Vulnerability Targeting Crypto Wallets

TLDR:

• Binance says the worse_query flaw affects iOS 26.7.1, 27.0.1, and 27.2, risking seed phrases and keys.
• Attackers use disguised sideloaded apps, such as fake file managers from Telegram, to exploit the flaw.
• Binance urges deleting untrusted apps, updating to iOS 27.2.1, and moving funds if a breach is suspected. 
• Binance also bars transactions involving MEXC after FinCEN named it a Primary Money Laundering Concern. 

An iOS vulnerability called worse_query may let malicious apps steal seed phrases and private keys from crypto wallets. Binance has warned iPhone users and advised an update to iOS 27.2.1, released on November 9.

How the iOS Vulnerability Works

Binance shared the warning through its official X account and labeled it as requiring immediate action. The exchange addressed the notice to all iPhone users.

It said the iOS vulnerability affects iOS versions 26.7.1, 27.0.1, and 27.2. Devices running these builds fall under the alert.

According to the post, worse_query allows a malicious app to read local files from other apps. The files at risk are stored locally on the device.

A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.…

— Binance (@binance) November 10, 2026

As a result, seed phrases, private keys, and login credentials may be exposed. These items control access to wallet funds and accounts. Binance said the risk extends across the entire ecosystem.

Binance described the problem as an iOS-level issue. It is not unique to Binance. Instead, the flaw breaks app isolation, which normally keeps each app’s data separate from the others. Because of this, a single malicious app could reach files stored by other apps.

Attackers trick users into installing disguised apps, such as fake file managers, to exploit the iOS vulnerability. These apps often come from untrusted sources like Telegram.

Sideloaded apps are installed outside the official App Store. Meanwhile, hardware wallets stay the safest option because their keys never touch the device.

Recommended Steps and MEXC Compliance Update

Binance listed several actions for iPhone users after outlining the iOS vulnerability. Users should delete any apps installed from untrusted sources. This includes sideloaded apps and manually signed IPAs. Such apps are how attackers reach the affected devices.

In addition, the exchange asked users to update iOS and all apps to the latest official versions. The recommended iOS update, version 27.2.1, was released on November 9. Binance also advised users never to install unauthorized packages.

Users who suspect a breach should transfer funds to a new wallet created on a clean device. Moving funds to the new wallet keeps them off the affected device. They should also reset all active login sessions. Binance issued these steps for anyone concerned about exposure.

Separately, Binance announced enhanced compliance measures in another post on X. The measures take effect immediately.

They follow FinCEN’s designation of MEXC as a Primary Money Laundering Concern. Binance told users not to send funds to or receive funds from MEXC, MEXC Global, or affiliated entities.

Binance is applying enhanced compliance measures following FinCEN’s designation of MEXC as a Primary Money Laundering Concern.

Effective immediately, users should not send funds to, receive funds from, or otherwise transact through Binance involving MEXC, MEXC Global, MEXC…

— Binance (@binance) November 10, 2026

The exchange also said users should not transact through Binance in any way involving these parties. Requests to send funds to MEXC addresses will be rejected.

Any direct or indirect transaction will face further review. Affected funds and accounts may be temporarily restricted during that review. Binance added that such activity may breach its Terms of Use.