Binance issued a warning on Tuesday regarding a recently discovered iOS vulnerability affecting certain iPhone models, which could expose crypto wallet recovery phrases and private keys when a malicious app is installed. The exchange clarified that the issue is not exclusive to its platform but stems from a file access risk inherent in the broader iOS ecosystem.
Affected Versions and Scope of the Risk
According to Binance, iOS versions 26.7.1, 27.0.1, and 27.2 are affected by this vulnerability. Malicious applications could exploit this flaw to gain access to local files associated with other apps, putting sensitive information like seed phrases, private keys, and login credentials at risk.
Binance noted that the issue is not exclusive to Binance but is a fundamental file access risk in the iOS ecosystem.
A spokesperson for Binance indicated that, thus far, there have been no verified incidents of attackers exploiting this flaw to access crypto wallets or steal funds. Nonetheless, the company stressed the importance of users exercising caution.
Security Recommendations for Users
The exchange advised users to remove any applications installed from unreliable sources and to update iOS and all apps to their official and latest versions. Users suspecting a breach should transfer their assets to new wallets created on a clean device.
Applications that store recovery phrases unencrypted on a device are at greater risk in such a security flaw. For users closely monitoring developments, CryptoAppsy offers a coin-specific news feed and smart price alerts, making it easier to track sudden security-related movements on one screen.
Initial Disclosure of the Vulnerability
Blockchain security firm SlowMist brought the issue to attention earlier in the day. The firm reported that a malicious application could access recovery phrases if a wallet app stores them unencrypted on the device.
SlowMist warns that if recovery phrases are stored unencrypted, malicious apps could potentially access this information.
The vulnerability was publicly disclosed on Sunday by an iOS security researcher using the alias forcequitOS. The discovery was attributed to another security expert known as 0xjohnny.
Apple Releases Updates Amid Ongoing Uncertainty
Apple released updates iOS 27.2.1 and 26.7.3 on Monday. However, it remains unclear whether these updates address the specific vulnerability. The company has not yet issued a public confirmation on the matter.
This development reignites discussions surrounding the security of wallet data stored on mobile devices. In particular, the methods of storing recovery phrases and private keys continue to be prominent topics in security advisories issued by centralized exchanges and wallet providers.
