Trust Wallet Says iPhone Users Face No Risk From iOS Sandbox Flaw

Trust Wallet said on Nov. 11 that its iPhone users are unaffected by the iOS sandbox flaw Binance flagged a day earlier, because the provider encrypts wallets on users' devices and never stores recovery phrases or private keys in plaintext.

The flaw, which Trust Wallet referred to as "worse_query," is a sandbox escape: a class of bug that lets one application read files inside another application's container. Binance warned on Nov. 10 that malicious apps could exploit it to reach seed phrases, private keys or login credentials held by other software on the same device.

Binance's warning named three specific iOS builds: 26.7.1, 27.0.1 and 27.2. According to the exchange's advisory, the sandbox escape can expose app containers on iOS 26.0 through 26.7.2 and on iOS 27.2 when an App Group container is present. App Groups are the iOS mechanism that lets multiple apps from the same developer share files, and their presence widens what an attacking app can reach.

Why Trust Wallet says its users are safe

Whether wallet secrets are exposed depends on two factors: what each app stores locally and how it protects that information. Trust Wallet's defense rests on both. The provider encrypts wallet data on the device itself, and it does not hold recovery phrases or private keys in unencrypted plaintext form, meaning an app that breaks the sandbox would still face encrypted material rather than readable secrets.

That positions Trust Wallet differently from wallet apps that keep seed phrases or credentials in cleartext inside their app containers, which would be directly readable under the conditions Binance described.

What Binance told users to do

Binance issued concrete remediation steps alongside its warning. The exchange advised users to:

• Remove apps installed from untrusted sources
• Install official iOS updates and official app updates
• If they suspect compromise, create a new wallet on a clean device, move their funds to it and reset all active login sessions

The guidance to reset login sessions matters because the flaw's reach extends beyond seed phrases to stored credentials for exchanges and other services, so a successful exploit could expose more than crypto keys.

What changes for iOS wallet users

The episode turns attention to a structural question for mobile crypto custody: sandbox escapes are not specific to any one wallet, and any app that stores secrets locally in plaintext is exposed whenever Apple's process isolation fails. Wallet providers that encrypt at rest before data touches shared or containerized storage reduce the damage a future escape can cause, while those that rely on the sandbox alone inherit whatever residual risk the operating system carries.

For now, affected iOS versions span 26.0 through 26.7.2 and 27.2, and the practical mitigation window runs until Apple ships patched builds that close the container exposure, making prompt installation of official updates the operative deadline for users holding assets on the named versions.