Hackers Are Draining Cryptocurrency Wallets on iPhones Due to a New Vulnerability in iOS

Binance, the world’s largest cryptocurrency exchange, has issued an urgent warning to iPhone users: delete any apps that were not downloaded from the official App Store. The reason is serious—a vulnerability called «worse_query» has been discovered in several versions of iOS, which potentially allows malicious programs to secretly read the private files of other apps on the same device.

Under normal circumstances, the iPhone keeps each app in an isolated environment—so one app cannot «peek» at another’s data. «worse_query» breaks down this protective barrier. If a malicious app is already installed on the phone, it can view, copy, or even modify files from other apps, including cryptocurrency wallets, saved passwords, messages, and photos.

This vulnerability poses a particular danger to crypto wallet owners: recovery phrases and private keys may be among the accessible files—which effectively grants full access to funds. This is precisely why Binance sounded the alarm: a hacker exploiting «worse_query» could completely empty a wallet or take over the victim’s account.

The vulnerability has been confirmed on devices running iOS 26.7.1, 27.0.1, and 27.2. An independent researcher going by the pseudonym Taj on GitHub suggested that the issue may affect nearly all versions of iOS 26—from 26.0 to 26.7.2. Apps installed outside the App Store undergo significantly less rigorous security checks, making them an ideal attack vector.

The report came a few days after Binance itself fell victim to a massive hack: the North Korean hacking group TraderTraitor stole $ 6.3 billion—an amount already being called the largest theft in the history of the cryptocurrency market. The new iOS threat is not related to that incident, but it could affect any iPhone user with a crypto wallet.

On Monday, Apple released security updates—iOS 26.7.3 and 27.2.1—as well as patches for older versions of the system. Among the fixes is protection against malicious apps accessing private data; however, «worse_query» is not explicitly mentioned in the update and, according to available data, remains unpatched. The editorial team reached out to Apple for comment.

No confirmed cases of «worse_query» being exploited by attackers have been reported yet. Binance advised users to update iOS to the latest version, delete apps from third-party sources, and, if a breach is suspected, transfer funds to a new wallet created on a clean device and log out of all active sessions. The exchange has promised to fully reimburse customers for any losses resulting from the North Korean attack.