Skip to content
securitytabs

Updated

Binance warns of public iOS sandbox escape that could expose wallet keys

Crypto exchange Binance says a publicly released flaw in Apple's iPhone software lets a malicious app read other apps' private files, including crypto wallet keys. No fix has been confirmed, so iPhone users holding crypto should watch for Apple's response.

iOS sandbox escape could expose crypto wallet keys
iOS sandbox escape could expose crypto wallet keys

What's new

Newest coverage

TimelineWhat should my organization do?

What happened

Binance warned on 10 November about an iOS sandbox escape, a flaw that lets one app break out of its isolation and read files belonging to other apps. Binance says seed phrases, private keys and login credentials could be exposed to a malicious app. [1][2][3]

The Hacker News reports that the exploit was published on GitHub by a researcher who goes by forcequit, working with 0xjohnny, and that it affects iPhones running iOS 26 and 27. BleepingComputer lists the affected versions as iOS 26.7.1, 27.0.1 and 27.2. [1][3]

Fix and exploitation status

The Hacker News reports that Apple's updates for iOS 26 and 27, released the day before Binance's warning, do not list a fix. Security Affairs reports that no attacks have been reported and no fix is confirmed. [1][2]

The coverage reviewed gives no CVE identifier, and Apple's own response is not quoted in it. [1][2][3]

Timeline

  1. Apple's latest iOS 26 and 27 updates were reported to list no fix for the flaw. [1]

  2. Binance named iOS 26.7.1, 27.0.1 and 27.2 as affected versions. [3]

  3. Binance warned users about the public iOS sandbox escape. [2]

Explained

The technology and terms in this story. Learn more

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Binance says a malicious app on an iPhone could read wallet keys and logins stored by other apps, and no fix has been confirmed. [1][3]

What to do

  1. Install only apps you trust on iPhones used for crypto or business logins. [2]
  2. Watch for Apple's security updates and install them when a fix is listed. [1]

Mid-size company

A small IT or security team

What to know

The exploit is public, affects iOS 26 and 27, and Apple's latest updates do not list a fix. No attacks have been reported. [1][2]

What to do

  1. Identify managed iPhones that hold wallet apps or sensitive credentials. [3]
  2. Track Apple's security releases for a fix to this flaw. [1]

Large enterprise

A security operations team

What to know

A public exploit could let a rogue app read other apps' files on iOS 26 and 27. Binance's warning concerns crypto secrets; no fix is confirmed and no attacks are reported. [1][2]

What to do

  1. Review which unapproved apps can be installed on managed iPhones that handle crypto assets or credentials. [3]
  2. Monitor Apple's advisories and prepare to deploy a fix once one is listed. [1]

Sources

  1. [1]The Hacker News · Nov 10, 12:15 UTC
    Binance Warns of iOS Sandbox Escape That Could Expose Crypto Wallet Keys, No Fix Confirmedcontext
  2. [2]Security Affairs · Nov 10, 15:46 UTC
    iOS Sandbox Escape Is Public, and Apple Hasn’t Confirmed a Fixcontext
  3. [3]BleepingComputer · Nov 10, 15:59 UTC
    Binance warns of iOS flaw that could leak crypto wallet secretscontext