Quick summary: "iPhone hacked" and "iPhone warning" searches jumped this week after crypto exchange Binance warned about an iOS flaw called worse_query. It can let a malicious app read files that belong to other apps, such as crypto wallet recovery phrases or saved logins. Proof-of-concept code is public, Apple has not said whether its latest update fixes it, and no thefts have been confirmed. Here is what it means and the exact steps to protect your iPhone.
What is worse_query?
Every iPhone app normally lives in its own "sandbox": it cannot see the files of other apps. worse_query is described as a sandbox escape. If a malicious app is installed on your phone, it could use this weakness to read local files stored by other apps.
- Affected versions named by Binance: iOS 26.7.1, iOS 27.0.1 and iOS 27.2.
- Who found it: a researcher known as forcequitOS, who published working code on GitHub.
- Confirmed? BleepingComputer reported that the tool worked on all three versions Binance named.
- Attacks so far: no thefts or attacks linked to the flaw have been reported.
Why Binance warned users
On November 10, Binance said the flaw puts "seed phrases, private keys, and login credentials" at risk and stressed that it is an iOS-level problem, not a bug in its own app. Crypto wallets are an obvious target because anyone who gets a wallet's recovery phrase can move the funds.
The risk is not limited to crypto. Any app that stores sensitive data locally on the device could, in theory, be exposed if a malicious app is installed alongside it.
Does iOS 27.2.1 fix it?
Apple released iOS 27.2.1 (and iOS 26.7.3 for older devices) on November 9, 2026, with several security fixes. However, Apple's release notes do not mention worse_query or a sandbox fix, and Apple has not said publicly whether the new update blocks it.
Our advice: install the update anyway. It closes other known holes, and many security fixes are not described in detail until later.
How to protect your iPhone (step by step)
- Update now: go to Settings > General > Software Update and install the latest version. Turn on Automatic Updates and Security Responses.
- Remove apps you don't trust: delete apps you no longer use, and anything installed from outside the App Store (sideloaded apps, alternative marketplaces, "enterprise" or test builds you don't recognise).
- Check profiles: open Settings > General > VPN & Device Management and remove any profile you did not install on purpose.
- Don't store recovery phrases on your phone: never keep seed phrases in Notes, Photos, screenshots or cloud documents. Write them on paper or use a hardware wallet.
- Move large crypto balances to a hardware wallet if you hold significant funds on a phone wallet.
- Use a password manager and turn on two-factor authentication (preferably passkeys or an authenticator app) for email, banking and exchange accounts.
- High-risk users (journalists, executives, activists, large crypto holders) can enable Lockdown Mode in Settings > Privacy & Security.
Signs your iPhone might be compromised
- Apps you don't remember installing.
- Unknown configuration profiles or device management.
- Unexpected login alerts, password-reset emails or 2FA codes.
- Wallet or bank transactions you didn't make.
If you see these, update iOS, remove suspicious apps and profiles, change important passwords from a different trusted device, and contact your bank or exchange immediately.
Don't fall for "iPhone hacked" pop-ups
Scammers love trending security news. Fake pop-ups claiming "Your iPhone is hacked, call Apple now" are not real. Apple does not show warnings with phone numbers. Read our guide on how tech support scams work; the same tricks are used with Apple's name.
FAQ
Can worse_query hack my iPhone by itself?
No. A malicious app must already be installed on your device to use it. That is why removing untrusted apps matters.
Which iOS versions are affected?
Binance named iOS 26.7.1, 27.0.1 and 27.2. Apple has not confirmed whether iOS 27.2.1 fixes it.
Has anyone lost money?
Binance and other reports say no losses linked to worse_query have been confirmed so far.
Sources
- 9to5Mac: Binance warns iPhone crypto holders of security flaw
- The Mac Observer: iOS 27.2.1 lists no fix for worse_query
- tbreak: BleepingComputer confirms worse_query works on named versions
- TweakTown: No losses linked to worse_query confirmed
- CoinCentral: iOS 27.2.1 and 26.7.3 notes do not name worse_query
- Bitcoin Magazine: Binance warns iOS flaw could expose wallet seed phrases