Binance says a public iPhone flaw could let a rogue app read crypto wallet keys. Apple's latest updates do not list a fix, and no thefts have been reported.
Binance, the crypto exchange, is warning iPhone owners about a flaw that could let one app read the private files of other apps. That could include the keys that unlock crypto wallets. The code behind it is public on GitHub. Apple's updates from yesterday do not list a fix. No attacks or thefts have been reported.
Every iPhone app lives in its own walled-off space, called a sandbox. It is meant to keep apps from snooping on each other. A researcher who goes by forcequit published code, called worse_query, that breaks out of that wall on iOS 26 and 27. He posted it on Sunday, a day before Apple's updates arrived.
Binance says the risk covers seed phrases (the word list that restores a wallet), private keys and login details. Its advice is to delete apps installed from untrusted sources and to update iOS and all apps.
The researcher says the code is for developers and "isn't useful by itself." But other developers have built apps on top of it. One is WQ Files, a file manager by Christoph Kolbicz. It reaches other apps' data without a jailbreak and can edit, delete and clear that data.
WQ Files installs through sideloading tools such as AltStore and SideStore. Sideloading means putting an app on your iPhone without the App Store. To work, the code needs an app to set up something called an App Group container, and those tools create one automatically.
Apple's notes say it does not discuss security issues until it has investigated and a fix is out. The researcher wrote on X that he had not planned to release the code early, but that Apple was "stalling on responding" to him.
If you hold no crypto and install apps only from the App Store, your risk looks lower, based on what is known so far. The clearest exposure is for people who sideload apps and keep crypto on the same iPhone. The alert box above lists the steps to take.
Watch for Apple's next update and for any change to its security notes. Also watch for word from Binance or wallet makers about affected apps.
If you keep crypto on an iPhone, remove any sideloaded apps now and install every update as soon as Apple releases it.
Ghana's cyber security agency says fake texts using the name TraffiTech-GH are going to drivers. One wrong tap could cost you money or personal details.
Read more: Fake TraffiTech-GH texts target drivers, Ghana cyber agency warnsMessages about an FTC Prime settlement payout are circulating. A real case does not make every message real, so check before you click or pay.
Read more: Prime settlement refund messages: how to tell real from fakeA robocall claims someone tried to change your Venmo password and asks you to press one. Venmo confirms it is a scam, and pressing a key could put your money at risk.
Read more: Fake Venmo password call is a scam. Don't press any number
