Vulnerabilities · Application Security
Binance warns iOS flaw could expose crypto wallet keys
A newly published iOS sandbox escape lets malicious apps access sensitive data, including crypto wallet keys, on iPhones running iOS 26 and 27. No fix is available yet, and Apple has not confirmed the issue.
Ross Grant3 min read
The short version
A security researcher has found a way for apps on some iPhones to read data from other apps, which is not supposed to happen. This could let a bad app steal sensitive information, like crypto wallet keys or passwords. Binance has warned users, but Apple has not confirmed the problem or fixed it yet. For now, users should avoid installing apps from untrusted sources.
What happened?
A researcher published a sandbox escape for iOS on GitHub, allowing apps to access other apps' data on iPhones running iOS 26 and 27. Binance warned this could expose crypto wallet keys and login credentials to malicious apps. Apple has not confirmed the flaw or released a fix. No attacks have been reported so far.
How the flaw works
A researcher known as forcequit has published a sandbox escape for iOS, called worse_query, on GitHub. This flaw allows an app to access files belonging to other apps on iPhones running iOS 26 and 27. Normally, iOS uses a sandbox to keep each app's data separate, so one app cannot read another's files. The escape breaks this isolation, letting a malicious app reach sensitive data, such as seed phrases and private keys used by crypto wallets, as well as login credentials.
To exploit the flaw, an app must set up an App Group container. The proof-of-concept code released by forcequit can reach every app's data container, and on iOS 27, it can also access some system folders. The code itself is intended for developers and "isn't useful by itself," according to the researcher. However, other developers have built apps on top of it that are now available for installation.
One such app is WQ Files, a file manager by Christoph Kolbicz, which can access and modify other apps' data without needing a jailbreak or kernel exploit. WQ Files is installed using sideloading tools like AltStore and SideStore, which create the required App Group automatically when used with an Apple ID. It is not clear whether an app from the official App Store could use worse_query.
Who is affected
The flaw affects iPhones running iOS 26 and 27. The versions listed as tested in the WQ Files release notes match those named in Binance's warning. Some developers believe the latest iOS update, 27.2.1 (released yesterday), is also affected, but this is based on a README update, not formal testing. There is no mention of the flaw in Apple's security notes for iOS 27.2.1 or iOS 26.7.3, and Apple has not confirmed the issue. Binance, the cryptocurrency exchange, warned that users' wallet keys and credentials could be at risk if they install untrusted apps.
The response
Binance has advised users to delete any apps installed from untrusted sources, such as sideloaded or manually signed apps, and to keep iOS and all apps updated. For anyone who suspects their device may be compromised, Binance recommends moving funds to a new wallet created on a clean device and resetting all active login sessions. Neither Binance nor the researcher has reported any real-world attacks or thefts using this flaw so far.
Is there a fix?
As of now, there is no confirmed fix for the sandbox escape. Apple's updates for iOS 26 and 27, released the day after the flaw was published, do not mention it or list any sandbox-related fixes. Apple typically does not discuss or confirm security issues until it has completed an investigation and released a patch. The researcher said on social media that the early release was due to a lack of response from Apple and growing public discussion about the flaw.
Claimed vs confirmed
- Unconfirmed
A sandbox escape on iOS 26 and 27 lets apps access other apps' data, risking exposure of crypto wallet keys and credentials.
Reported by The Hacker News and warned by Binance, but not confirmed by Apple or other primary sources.
- Confirmed
No attacks or thefts have occurred using this flaw.
Both Binance and the researcher say there are no reports of real-world attacks so far.
Why it matters
Sensitive information like crypto wallet keys and login credentials could be exposed if a malicious app uses this flaw. There is no fix yet, so users are at risk until Apple addresses the issue. The story highlights the risks of sideloading apps and the importance of keeping devices updated.
Key points
- A new iOS flaw lets apps access other apps' data, breaking sandbox isolation.
- Crypto wallet keys and login credentials could be exposed to malicious apps.
- No fix is available yet, and Apple has not confirmed the issue.
- Binance advises deleting untrusted apps and moving funds if a breach is suspected.
- The flaw affects iPhones running iOS 26 and 27, including recent updates.
Sources
The Hacker News
Reference
