Binance Flags Critical iOS Sandbox Flaw Threatening Crypto Wallets
Key Summary
Binance issued an emergency warning regarding an iOS sandbox escape flaw named worse_query that allows malicious apps to access local crypto wallet files. The vulnerability affects multiple versions of iOS 26 and iOS 27, putting private keys and seed phrases at risk across unpatched devices.
Key Bullets
- Binance issued a security alert regarding the worse_query iOS vulnerability affecting specific software versions from iOS 26 to iOS 27.
- The sandbox escape exploit allows malicious applications to read local files belonging to other applications on the same device.
- SlowMist security specialists confirmed that the vulnerability undermines core application isolation mechanisms protecting plaintext seed phrases.
- CertiK separately reported ongoing attacks via the DarkSword exploit framework targeting unpatched mobile devices across the ecosystem.
Sandbox Escape Threatens Mobile Assets
Binance warned Apple users Monday about a dangerous iOS vulnerability dubbed worse_query that exposes crypto wallets, private keys, and login credentials to malicious third-party applications. Public GitHub repository documentation shows the sandbox escape affects iOS 26.0 through 26.7. 2 alongside iOS 27.2.
The exploit bypasses Apple application isolation frameworks. Malicious software can read local directories normally restricted to other installed applications. Crypto holders storing recovery phrases locally face immediate operational risk.
Patch Gaps Leave Traders Exposed
Apple security advisories published following software releases on October 26, 2026, do not explicitly identify the worse_query vulnerability by name. Independent GitHub project audits reported that available operating system patches had not closed the specific sandbox bypass vector.
SlowMist security leads stated that the flaw undermines fundamental container isolation assumptions. Binance urged affected users to migrate funds to clean hardware immediately.
Broader Mobile Attack Wave
The mobile security alert arrives amid a wider wave of smartphone targeting across digital asset ecosystems. CertiK telemetry identified the DarkSword exploit framework targeting unpatched iPhones through compromised browser sessions without requiring wallet signatures.
Earlier in September, Binance flagged malicious code inside third-party application FomoPeek versions 1.1 and 1.2. Self-custody security demands strict device hygiene.
The $5.90B Security Breach Legacy Driving Wallet Defenses
Today's development follows an established trajectory that began on November 7, 2026, when attackers linked to a massive $5.90B security breach drained an additional 2,300 Bitcoin from Binance hot wallets. That historical incident triggered widespread margin liquidations totaling $410M and prompted emergency stablecoin freezes by Tether and Circle, which successfully froze over $2.30B in combined USDT and USDC. During the ongoing crisis, Changpeng Zhao warned that automated threat vectors are scaling faster than traditional asset protection infrastructure. This operational pressure heavily informs today's urgent warnings regarding unpatched mobile sandbox vulnerabilities and the necessity of immediate hardware wallet migration.
Impact score:4 out of 5 | Narrative Tracker:Security, Exploits & Asset Recovery
About CryptoNewsFree Market Intelligence Wire
The CryptoNewsFree Market Intelligence Wire provides rapid, objective coverage of breaking crypto developments, regulatory actions, and market liquidity trends. Our reporting strictly follows our Editorial & Verification Standards.