What happened
On 10 November 2026, several security reports warned Bitcoin wallet users about a public iOS technique called worse_query. The researcher describes it as a sandbox escape for iOS 26 and 27. A sandbox normally keeps one app from reading another app's private files. The published proof of concept can instead reach the folders where iOS stores app data.
The code was published on 8 November. It needs an App Group container and is not useful by itself, according to its author. Other developers have built file tools around it. Those tools must be installed on the phone, such as through sideloading. No report has shown the technique arriving through Apple's App Store.
Binance warned iPhone users that a malicious app could expose recovery phrases, private keys and login details stored by other apps. The exchange named iOS 26.7.1, 27.0.1 and 27.2. It did not name an affected Bitcoin wallet or report a theft.
What it changes
The disclosure weakens an important boundary between apps on affected iPhones. If a software wallet writes a recovery phrase or private key into a readable file, a malicious app using the technique may be able to copy it. A recovery phrase can recreate a wallet and spend its bitcoin, so exposure is enough to require moving funds to new keys.
The practical risk depends on two separate conditions. The user must install a malicious app that can use the escape, and the wallet must leave useful secrets in storage that the app can read. A wallet that keeps signing keys inside dedicated hardware does not expose those keys merely because an iPhone file can be read.
Apple released iOS 27.2.1 and iOS 26.7.3 on 9 November. Its iOS 27.2.1 security notes list nine fixes, including an App Intents issue that could expose sensitive user data. They do not mention worse_query, its researchers or an App Group container flaw. Apple has not publicly confirmed whether either update blocks the published technique.
What it does not change
There is no confirmed Bitcoin theft tied to worse_query. Cointelegraph said Binance had found no confirmed wallet access or loss using the bug. The researcher calls the release a developer proof of concept, not a complete attack.
The flaw does not break Bitcoin signatures, recovery phrases or the Bitcoin network. It is a device isolation failure. It matters when sensitive wallet material is stored on that device in a form another app can use.
Updating iOS is still sensible because the latest releases contain other security fixes. It is not proof that this specific route is closed. Users should also remove untrusted sideloaded apps. Anyone who suspects exposure needs a new wallet created on a clean device, then must move funds to its new addresses. Changing an app password does not change a compromised recovery phrase.
Context
At least four separately owned newsrooms reported the warning. Decrypt checked the public code and Apple's release notes. Cointelegraph obtained a Binance response saying no confirmed cases had been identified. BleepingComputer explained that an attacker still has to get an app onto the phone. The Hacker News distinguished the researcher's wider version range from the smaller set Binance tested.
The reports agree that installed code can cross an app boundary and that no wallet loss is confirmed. They differ on whether Apple's new updates stop it. Until Apple or the researcher publishes a verified test, the narrow conclusion is that the exposure is public, while the patch status and real-world reach remain unsettled.