Binance confirms a new iOS exploit is being used to drain wallets.

[Rikafip]

Fair question, I think some folks used old iphones as a hardware wallet to store their crypto.

And then using Trust wallet in order to store that crypto? Doesn't make much sense to me, but people tend to do all kind of stupid stuff.

They didn't refund my stolen funds, when version 2.68 exploit happened and I swear to god not to use that wallet anymore.

How that exactly happened? If you are willing to share the story ofc.

[joniboini]

And then using Trust wallet in order to store that crypto? Doesn't make much sense to me, but people tend to do all kind of stupid stuff.

I can only imagine they have various alts, don't want to deal with a dedicated wallet for each of them, too lazy to find other multi-currency wallets when they used Trust Wallet already, and so on. A single instance of carelessness can cause thing like this to happen.

[Zwei]

i read that trust wallet were keeping seed phrases in raw plaintext RAM, if that's true, then they are also to blame.

I'd like to read it, do you remember where you read this?
A link to the article/news would be great.

i read that a while ago on twitter, but i can't seem to find the tweet with the details anymore. sorry 

Because depending on the context, it might just be a normal operation of decrypting the secrets (thus, will be saved in RAM for a few milliseconds) to be able to sign transactions, etc.
Or if it's something stupid, like keeping it plaintext in memory during the whole operation, then it doesn't need a compromised OS to be vulnerable.

i think it was something like that, if my memory is not failing me, the seed phrase was kept in plaintext cached in memory while the wallet was unlocked.
but maybe that issue isn't related to this drain, as it seems they fixed it a few months ago: https://github.com/trustwallet/wallet-core/pull/4615 https://github.com/trustwallet/wallet-core/pull/4667

you know this stuff better than me, so please correct me if i'm wrong.

[ultrloa]

They didn't refund my stolen funds, when version 2.68 exploit happened and I swear to god not to use that wallet anymore.

How that exactly happened? If you are willing to share the story ofc.

Due to this incident happened on their chrome extension before https://trustwallet.com/blog/company/trust-wallet-browser-extension-v268-incident-community-update

Then keep following up my case and this is last response I got from them.





And I give up and move on, until now didn't hear anything from them.

So avoid using Trust wallet guys.

[stompix]

Fair question, I think some folks used old iphones as a hardware wallet to store their crypto.
With this new hardware wallet hacks/leaks people who were considering using old iphones to store crypto should rethink again.

The vulnerability has been known for months, this is nothing new, the first major DarkSword spread happened 6 months ago and there is a patch for that for every iPhone since April!
Now, unless you go and download stupid things from shady websites or you open attachments you received from strangers in you emails, you're safe.
Somebody who uses this strictly a hardware wallet and not for day-to-day phone browsing, everything is safe.

CMIIW, but even if the iOS is exploited, shouldn't the wallet data remain secure, assuming it's encrypted with user PIN or password?

Not really, depends how that data is stored:
https://slowmist.medium.com/threat-intelligence-analysis-of-the-darksword-trojan-backend-and-ios-attack-chain-397ecf499fa8

Its capabilities range from routine collection of camera, microphone, photo library, contacts, SMS, Wi-Fi passwords, and location data to Keychain and iCloud token extraction, clipboard reading and hijacking, foreground app monitoring, shell command execution, persistence installation, SOCKS5 proxy setup, DNS-based exfiltration, and eventual self-destruction.

[ABCbits]

CMIIW, but even if the iOS is exploited, shouldn't the wallet data remain secure, assuming it's encrypted with user PIN or password?

Not really, depends how that data is stored:
https://slowmist.medium.com/threat-intelligence-analysis-of-the-darksword-trojan-backend-and-ios-attack-chain-397ecf499fa8

Its capabilities range from routine collection of camera, microphone, photo library, contacts, SMS, Wi-Fi passwords, and location data to Keychain and iCloud token extraction, clipboard reading and hijacking, foreground app monitoring, shell command execution, persistence installation, SOCKS5 proxy setup, DNS-based exfiltration, and eventual self-destruction.

I forget OS level keychain is a thing. I expect many developer use it since user can just re-use same approach they use to unlock their screen and it's probably easier to integrate keychain rather than introduce separate encryption feature.

[lovesmayfamilis]

Keeping the system updated is what prevents this type of problem. It's even questionable why someone would use an outdated system and still have a cryptocurrency wallet installed on that same system. The thing is, not everyone can afford a new, more up-to-date phone, and this ends up making them more vulnerable to attacks. I've had to change phones because I no longer received updates, which I think is absurd. Sometimes the time window isn't even that long, but since I have banking apps and wallets, I have to find a way to buy them.

You know perfectly well why this is being done. None of the manufacturers are concerned about our problems, exactly those related to the financial situation and the inability to regularly purchase new models. The manufacturer's own business is important, which means that he will constantly strive to ensure that models receive higher versions, although everyone understands that new models do not always have the capabilities that will make it necessary to update the device. In addition, last year's news for some countries, specifically for Russia, said that when upgrading to certain versions, their phones turned into "bricks." The news concerned one country, but many others were suspicious of the update.

https://ren.tv/news/v-rossii/1421594-iphone-v-rossii-nachali-massovo-prevrashchatsia-v-kirpichi-posle-obnovleniia
https://lenta.ru/news/2025/06/11/polzovateli-predupredili-o-prevraschenii-iphone-v-kirpich-iz-za-obnovleniya/

[suzanne5223]

I can only question

Why are people using iOS 18.5?? This was launched in 2024, 2 years and they did not update their phones?

It is important to notice that this is an issue with an exploit in old iOS versions and not trust wallet. With this exploit you can steal the data from many apps in the phone

Like your question but we also need to question the reason why Trust wallet users on the affected iOS versions which are mainly in the 18.4-18.7 range (and older for Coruna) are only those that are affected because something seems to be missing somewhere despite the issue of old iOS version.
The last time I checked people have been advised several times not to use the Trust wallet.

[348Judah]

Trust Wallet users are being drained, with $5.1M stolen so far.

An exploit targeting devices running iOS 18.5 allows an unknown attacker to secretly extract victims seed phrases from their phones.

Trust Wallet support has asked users to update iOS as soon as possible.

https://x.com/TrustWallet/status/2118592671539192132

Updating their OS is not even the solution enough because some are already been affected, maybe this could have been detected earlier before the attack go viral to this extent.

I don't even like the fact that trust wallet is a non-custodial closed source wallet, had it been it was discovered to be an open source, maybe I wouldn't believe them too much on this incidence, we just have to be more careful on different mode of attack they are using these days to hack into our wallet and steal our coins.

[Murat]

UPDATE

A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.

Immediate Action Required:
- Delete any apps installed from untrusted sources (such as sideloaded or manually signed IPAs).
- Update iOS and all apps to the latest official versions.
- If you suspect a breach, transfer funds to a new wallet created on a clean device and reset all active login sessions.

Never install unauthorized packages, and keep your software up to date.

Source > https://x.com/binance/status/2120093246399430770

[TastyChillySauce00]

I can only question

Why are people using iOS 18.5?? This was launched in 2024, 2 years and they did not update their phones?

It is important to notice that this is an issue with an exploit in old iOS versions and not trust wallet. With this exploit you can steal the data from many apps in the phone

Like your question but we also need to question the reason why Trust wallet users on the affected iOS versions which are mainly in the 18.4-18.7 range (and older for Coruna) are only those that are affected because something seems to be missing somewhere despite the issue of old iOS version.
The last time I checked people have been advised several times not to use the Trust wallet.

It's not only trust wallet, other wallet also affected because the exploit can dump memory and scan for seed phrases in plaintext or even screenshots. Researcher even found proof that other wallets are also being targeted from hardcoded wallet search term from the decompiled exploit kit.



Trustwallet get the spotlight because I think the incident went viral and cites Trustwallet. After the cause of the hacking is known, pretty much any self custodial wallet is considered affected by the exploit.

[avp2306]

UPDATE

A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.

Immediate Action Required:
- Delete any apps installed from untrusted sources (such as sideloaded or manually signed IPAs).
- Update iOS and all apps to the latest official versions.
- If you suspect a breach, transfer funds to a new wallet created on a clean device and reset all active login sessions.

Never install unauthorized packages, and keep your software up to date.

Source > https://x.com/binance/status/2120093246399430770

People need to pay close attention on this, because this one is pretty much dangerous.

Imagine they already reached unto that level. I guess many people might fall on this exploit if they won't IOS users didn't get an update regarding in this matters.

So I guess its best not to do anything with their phones, like installing something they don't know right now, so they can avoid experiencing any serious issues.