Binance Warns iPhone Users of iOS Flaw Exposing Wallet Recovery Phrases

Binance has warned that a security vulnerability in iOS versions 26.7.1, 27.0.1 and 27.2 could allow malicious applications to read local files belonging to other apps, potentially exposing cryptocurrency wallet recovery phrases, private keys and login credentials stored unprotected on the device.

The exchange disclosed the flaw in a public statement and attributed the problem to the iOS operating system's security mechanisms rather than to its own platform. Binance stressed that the issue is not specific to its app; any application that stores sensitive material in readable local files on an affected iPhone is exposed. That includes the twelve- or twenty-four-word recovery phrases that control self-custodied Bitcoin and altcoin wallets.

How does the vulnerability work?

According to Binance, a malicious application installed on an affected device can access and read local files of other applications that it would not normally be permitted to touch. If a wallet app or exchange client keeps a recovery phrase, private key or saved login credentials in an unencrypted local file, that data becomes retrievable by the attacker's code.

In plain words: on the listed iOS builds, the wall between apps is not holding for certain files, and whatever a user stored in plain text can leak to a hostile app.

The warning carries a significant caveat. Binance said it has not encountered any verified case in which a crypto wallet was accessed or funds were stolen through this vulnerability. The disclosure is precautionary, not a response to a confirmed loss; the exchange has not published figures on affected users or attempted exploits.

What does Binance advise users to do?

The exchange issued four recommendations:

• Delete applications downloaded from untrusted sources, especially those installed through sideloading or manually signed IPA files.
• Update iOS and all installed applications to the latest official versions.
• If a security breach is suspected, create a new wallet on a clean, virus-free device.
• Transfer all assets to that new wallet and reset every active login session.

The advice effectively concedes that a compromised device cannot be trusted again. Migrating assets to a freshly generated wallet, rather than merely changing passwords, is the standard response once a recovery phrase may have been exposed.

The recommendation against sideloaded and manually signed IPA installations points to the practical attack surface. Applications distributed outside the official App Store review process are the realistic vector for the malicious code this vulnerability would enable, so users who install only vetted App Store software face a narrower risk.

What remains unanswered?

Binance's statement does not say whether Apple has acknowledged the flaw, whether a patch is scheduled, or whether the affected version list is exhaustive. The exchange also did not specify which wallet or exchange applications store sensitive material in the unprotected manner described, leaving users to verify their own exposure.

Until Apple ships a fix or clarifies the affected builds, the operational guidance stands on its own: update iOS, remove sideloaded software, and treat any device suspected of compromise as unfit to hold keys. Users who act before an exploit is confirmed will not need the warning after one is.