Binance Flags iOS Exploit As European Account Closures Loom
Key Summary
Binance issued urgent security warnings regarding a severe iOS vulnerability endangering private keys and seed phrases while European entities prepared for mandatory account closures by December 31 following MiCA licensing hurdles.
Key Bullets
- Binance issued urgent warnings regarding an iOS vulnerability dubbed worse_query targeting specific mobile software versions and risking seed phrase exposure.
- Public statements from exchange security teams advised users to immediately purge sideloaded applications and migrate assets to clean devices.
- Social media disclosures confirmed multiple wallet drains affecting Exodus and Phantom mobile applications across compromised smartphone configurations.
- Regulatory pressure in Europe mounted as Binance France scheduled complete account closures by December 31 following MiCA licensing failures.
Binance Issues Urgent iOS Security Warning
Binance warned users of a severe vulnerability affecting iOS versions 26.7. 1, 27.0. 1, and 27.2 that exposes private keys and seed phrases to malicious applications. According to statements published on X by exchange representatives, the exploit allows unauthorized third-party apps to read local files across the device.
The exchange clarified that the flaw exists at the operating system level rather than within its own trading infrastructure. Co-founder Changpeng Zhao advised traders to apply mobile software updates immediately. Security researchers tracked ongoing wallet drains affecting mobile installations on compromised devices.
Widespread Mobile Wallet Drains Reported
Traders across social media reported unexpected wallet liquidations affecting non-custodial applications including Exodus and Phantom. On-chain observers documented unauthorized asset transfers occurring overnight while private credentials remained stored securely off-line.
Exchange security advisories directed affected individuals to migrate remaining funds to newly generated wallets on isolated hardware. Users were told to delete all sideloaded IPA packages immediately.
European Operations Face Imminent Closure
Regulatory filings and internal notices confirmed that Binance France will shutter all regional customer accounts by December 31 following missed MiCA compliance deadlines. Local traders must withdraw assets prior to November 29 to avoid tiered administrative penalties of 0.025% or 10.00 USDC.
Additional disclosures pointed to parallel account terminations arriving by New Year Eve across Spain, Italy, and Poland. The European wind-down compounds ongoing treasury recovery efforts stemming from previous protocol exploits.
The Origins of the Worse Query Sandbox Vulnerability
Today's development follows an established trajectory that began on Nov 10, 2026, when Binance first published emergency security alerts regarding the worse_query vulnerability impacting iOS versions 26 and 27. During those initial disclosures, SlowMist security specialists confirmed that the sandbox escape flaw allowed malicious applications to read local files belonging to other apps on the same device. CertiK separately reported ongoing attacks via the DarkSword exploit framework targeting unpatched mobile devices across the ecosystem, prompting exchange engineers to urge retail traders to migrate funds to hardware cold storage.
Impact score:4 out of 5 | Narrative Tracker:Security, Exploits & Asset Recovery
About CryptoNewsFree Market Intelligence Wire
The CryptoNewsFree Market Intelligence Wire provides rapid, objective coverage of breaking crypto developments, regulatory actions, and market liquidity trends. Our reporting strictly follows our Editorial & Verification Standards.