Skip to content
OriginalSign in
Image: The Hacker News

The Hacker Newsinfo@thehackernews.com (The Hacker News)

Binance warns iOS sandbox escape could expose crypto wallet keys

Part of the Binance story · since 30 Oct

Developinglatest 3 hours ago28 articles11 outlets
30 Oct · Security Affairs first5 Nov7 Nov9 NovNowThis article28th of 28
  • Fri 30 Oct, 00:30 UTC. Security Affairs, first report. Binance Investigates Suspicious Crypto Transfers Worth $5.8 Billion.
  • Fri 30 Oct, 02:00 UTC. SecurityOnline, its first report on the story. Binance investigates suspected hot wallet breach and transfers.
  • Fri 30 Oct, 06:00 UTC. The Hacker News, its first report on the story. Binance reports breach affecting $6.3 billion in assets.
  • Fri 30 Oct, 08:30 UTC. SecurityWeek, its first report on the story. North Korea’s TraderTraitor linked to $6.36 billion Binance heist.
  • Fri 30 Oct, 09:00 UTC. SecurityOnline. Binance probe traces $6.36 billion hack to DevOps breach.
  • Fri 30 Oct, 09:30 UTC. SOCRadar, its first report on the story. Binance reports $6.3 billion theft from its hot wallets.
  • Fri 30 Oct, 12:00 UTC. Infosecurity, its first report on the story. Analysts attribute Binance’s $6.3bn hack to North Korean group.
  • Fri 30 Oct, 13:00 UTC. Malwarebytes, its first report on the story. Binance reports $6.3 billion theft linked to North Korean group.
  • Fri 30 Oct, 14:30 UTC. Ars Technica, its first report on the story. TRM Labs links record $6.3 billion Binance heist to North Korea.
  • Fri 30 Oct, 19:30 UTC. Security Affairs. TRM Labs attributes $6.3 billion Binance theft to North Korea.
  • Fri 30 Oct, 23:00 UTC. StepSecurity, its first report on the story. Binance hack highlights risks to developer machines and signing.
  • Sun 1 Nov, 08:30 UTC. The Hacker News. FBI blames North Korea group for $6.43 billion Binance heist.
  • Sun 1 Nov, 09:55 UTC. cybersixt, its first report on the story. Binance cyberattack: how North Korea launders the stolen $6.4B.
  • Sun 1 Nov, 20:30 UTC. Security Affairs. FBI blames North Korea linked group for Binance theft.
  • Mon 2 Nov, 09:30 UTC. SecurityWeek. FBI Links North Korea’s TraderTraitor to Binance Heist.
  • Mon 2 Nov, 11:00 UTC. Infosecurity. FBI links Binance crypto breach to North Korea’s TraderTraitor.
  • Mon 2 Nov, 23:30 UTC. Dark Reading, its first report on the story. Binance Hack Shows How One Laptop Led to Billions in Losses.
  • Tue 3 Nov, 10:30 UTC. SecurityOnline. FBI attributes $6.3 billion Binance heist to North Korea.
  • Tue 3 Nov, 18:00 UTC. The Hacker News. Binance Details How Fake Interviews Led to $6.43 Billion Theft.
  • Tue 3 Nov, 20:30 UTC. Security Affairs. Binance details how fake job interviews enabled a $6.34B hack.
  • Wed 4 Nov, 02:00 UTC. SecurityOnline. FBI links Binance wallet theft to North Korean actors.
  • Wed 4 Nov, 10:00 UTC. Infosecurity. Fake interview campaign leads to major Binance crypto heist.
  • Wed 4 Nov, 10:00 UTC. SecurityWeek. North Korea protests US claims linking hackers to Binance heist.
  • Wed 4 Nov, 11:30 UTC. SecurityWeek. Binance details $6.34 billion theft linked to North Korean group.
  • Wed 4 Nov, 17:00 UTC. Ars Technica. Binance says hackers planned $6.3 billion crypto heist for months.
  • Tue 10 Nov, 10:00 UTC. Infosecurity. Binance investigates ShinyHunters' claims of stolen customer data.
  • Tue 10 Nov, 10:46 UTC. cybersixt. Public Apple iOS sandbox escape lets apps read other apps' data.
  • Tue 10 Nov, 13:30 UTC. The Hacker News. Binance warns iOS sandbox escape could expose crypto wallet keys. This article, 28th of 28.

Binance has warned of an iOS sandbox escape named worse_query, published on GitHub by a researcher going by forcequit, which could allow an iPhone app to read other apps’ files on devices running iOS 26 and 27. The flaw could expose seed phrases, private keys, and login credentials to malicious apps. The researcher’s proof‑of‑concept code demonstrates access to every app’s data container on an iPhone and, on iOS 27, some system folders, provided an app can set up an App Group container. Binance noted that Apple’s updates for iOS 26 and 27, released yesterday, do not list a fix for this escape.

Binance’s warning points to real‑world risk through apps such as WQ Files, a file manager developed by Christoph Kolbicz, which has used worse_query to reach other apps’ data without jailbreaks or kernel exploits, including the ability to edit, delete, and clear that data. The three versions cited in the warning are those tested in WQ Files’ release notes, though the researcher has suggested a broader range.

No attacks or thefts have been reported publicly, and it remains unclear whether an App Store–distributed app could leverage the escape. Binance advises users to delete apps installed from untrusted sources, update iOS and all installed apps, and, if a breach is suspected, move funds to a new wallet created on a clean device and reset all active login sessions. The iOS 27.2.1 and 26.7.3 notes did not mention worse_query or sandbox issues.

How the story developed

All 28 articles
Developinglatest 3 hours ago28 articles11 outlets

28 articles from 11 outlets since 30 Oct. Picked up again today after 6 days quiet. This was the 28th report, 12 days after the first.

Now30 Oct311 Nov234First reportSecurity Affairs · 30 Oct, 00:30This article28th of 28 · day 11Picked up againafter 6 days quiet
  • Fri 30 Oct, 00:30 UTC. Security Affairs, first report. Binance Investigates Suspicious Crypto Transfers Worth $5.8 Billion.
  • Fri 30 Oct, 02:00 UTC. SecurityOnline, its first report on the story. Binance investigates suspected hot wallet breach and transfers.
  • Fri 30 Oct, 06:00 UTC. The Hacker News, its first report on the story. Binance reports breach affecting $6.3 billion in assets.
  • Fri 30 Oct, 08:30 UTC. SecurityWeek, its first report on the story. North Korea’s TraderTraitor linked to $6.36 billion Binance heist.
  • Fri 30 Oct, 09:00 UTC. SecurityOnline. Binance probe traces $6.36 billion hack to DevOps breach.
  • Fri 30 Oct, 09:30 UTC. SOCRadar, its first report on the story. Binance reports $6.3 billion theft from its hot wallets.
  • Fri 30 Oct, 12:00 UTC. Infosecurity, its first report on the story. Analysts attribute Binance’s $6.3bn hack to North Korean group.
  • Fri 30 Oct, 13:00 UTC. Malwarebytes, its first report on the story. Binance reports $6.3 billion theft linked to North Korean group.
  • Fri 30 Oct, 14:30 UTC. Ars Technica, its first report on the story. TRM Labs links record $6.3 billion Binance heist to North Korea.
  • Fri 30 Oct, 19:30 UTC. Security Affairs. TRM Labs attributes $6.3 billion Binance theft to North Korea.
  • Fri 30 Oct, 23:00 UTC. StepSecurity, its first report on the story. Binance hack highlights risks to developer machines and signing.
  • Sun 1 Nov, 08:30 UTC. The Hacker News. FBI blames North Korea group for $6.43 billion Binance heist.
  • Sun 1 Nov, 09:55 UTC. cybersixt, its first report on the story. Binance cyberattack: how North Korea launders the stolen $6.4B.
  • Sun 1 Nov, 20:30 UTC. Security Affairs. FBI blames North Korea linked group for Binance theft.
  • Mon 2 Nov, 09:30 UTC. SecurityWeek. FBI Links North Korea’s TraderTraitor to Binance Heist.
  • Mon 2 Nov, 11:00 UTC. Infosecurity. FBI links Binance crypto breach to North Korea’s TraderTraitor.
  • Mon 2 Nov, 23:30 UTC. Dark Reading, its first report on the story. Binance Hack Shows How One Laptop Led to Billions in Losses.
  • Tue 3 Nov, 10:30 UTC. SecurityOnline. FBI attributes $6.3 billion Binance heist to North Korea.
  • Tue 3 Nov, 18:00 UTC. The Hacker News. Binance Details How Fake Interviews Led to $6.43 Billion Theft.
  • Tue 3 Nov, 20:30 UTC. Security Affairs. Binance details how fake job interviews enabled a $6.34B hack.
  • Wed 4 Nov, 02:00 UTC. SecurityOnline. FBI links Binance wallet theft to North Korean actors.
  • Wed 4 Nov, 10:00 UTC. Infosecurity. Fake interview campaign leads to major Binance crypto heist.
  • Wed 4 Nov, 10:00 UTC. SecurityWeek. North Korea protests US claims linking hackers to Binance heist.
  • Wed 4 Nov, 11:30 UTC. SecurityWeek. Binance details $6.34 billion theft linked to North Korean group.
  • Wed 4 Nov, 17:00 UTC. Ars Technica. Binance says hackers planned $6.3 billion crypto heist for months.
  • Tue 10 Nov, 10:00 UTC. Infosecurity. Binance investigates ShinyHunters' claims of stolen customer data.
  • Tue 10 Nov, 10:46 UTC. cybersixt. Public Apple iOS sandbox escape lets apps read other apps' data.
  • Tue 10 Nov, 13:30 UTC. The Hacker News. Binance warns iOS sandbox escape could expose crypto wallet keys. This article, 28th of 28.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 28 articles as a list
  1. Fri 30 OctDay 011
    1. Binance Investigates Suspicious Crypto Transfers Worth $5.8 Billion00:30 · Security Affairs · First report
    2. Binance investigates suspected hot wallet breach and transfers02:00 · SecurityOnline
    3. Binance reports breach affecting $6.3 billion in assets06:00 · The Hacker News
    Show 8 more from 30 Oct
    1. North Korea’s TraderTraitor linked to $6.36 billion Binance heist08:30 · SecurityWeek
    2. Binance probe traces $6.36 billion hack to DevOps breach09:00 · SecurityOnline
    3. Binance reports $6.3 billion theft from its hot wallets09:30 · SOCRadar
    4. Analysts attribute Binance’s $6.3bn hack to North Korean group12:00 · Infosecurity
    5. Binance reports $6.3 billion theft linked to North Korean group13:00 · Malwarebytes
    6. TRM Labs links record $6.3 billion Binance heist to North Korea14:30 · Ars Technica
    7. TRM Labs attributes $6.3 billion Binance theft to North Korea19:30 · Security Affairs
    8. Binance hack highlights risks to developer machines and signing23:00 · StepSecurity
  2. Sun 1 NovDay 23
    1. FBI blames North Korea group for $6.43 billion Binance heist08:30 · The Hacker News
    2. Binance cyberattack: how North Korea launders the stolen $6.4B09:55 · cybersixt
    3. FBI blames North Korea linked group for Binance theft20:30 · Security Affairs
  3. Mon 2 NovDay 33
    1. FBI Links North Korea’s TraderTraitor to Binance Heist09:30 · SecurityWeek
    2. FBI links Binance crypto breach to North Korea’s TraderTraitor11:00 · Infosecurity
    3. Binance Hack Shows How One Laptop Led to Billions in Losses23:30 · Dark Reading
  4. Tue 3 NovDay 43
    1. FBI attributes $6.3 billion Binance heist to North Korea10:30 · SecurityOnline
    2. Binance Details How Fake Interviews Led to $6.43 Billion Theft18:00 · The Hacker News
    3. Binance details how fake job interviews enabled a $6.34B hack20:30 · Security Affairs
  5. Wed 4 NovDay 55
    1. FBI links Binance wallet theft to North Korean actors02:00 · SecurityOnline
    2. Fake interview campaign leads to major Binance crypto heist10:00 · Infosecurity
    3. North Korea protests US claims linking hackers to Binance heist10:00 · SecurityWeek
    Show 2 more from 4 Nov
    1. Binance details $6.34 billion theft linked to North Korean group11:30 · SecurityWeek
    2. Binance says hackers planned $6.3 billion crypto heist for months17:00 · Ars Technica

  6. Quiet for 6 days

    Tue 10 NovDay 113
    1. Binance investigates ShinyHunters' claims of stolen customer data10:00 · Infosecurity · Picked up again
    2. Public Apple iOS sandbox escape lets apps read other apps' data10:46 · cybersixt
    3. Binance warns iOS sandbox escape could expose crypto wallet keys13:30 · The Hacker News · This article, 28th of 28

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in