Audit name:
[PT] BingX | Android | Sep2025
Date:
Oct 31, 2025
Table of Content
Introduction
We express our gratitude to the BingX team for the collaborative engagement that enabled the execution of this Pentest.
BingX is a leading global cryptocurrency exchange and Web3 AI company, founded in 2018, serving over 20 million users. It distinguishes itself through a strong focus on integrating artificial intelligence into its ecosystem, positioning itself as the first "All-in-AI" crypto exchange. BingX offers a comprehensive suite of products, including spot, derivatives, and copy trading, catering to traders of all levels.
Document | |
|---|---|
| Name | Pentest and Security Analysis Report for BingX |
| Audited By | |
| Approved By | |
| Website | https://bingx.com→ |
| Changelog | 25/09/2025 - Preliminary Report |
| Changelog | 24/10/2025 - Final Report |
| Platform | https://bingx.com/en→ |
| Language | Java |
| Tags | Pentest, BlackBox |
| Methodology | https://hackenio.cc/pentest_methodology→ |
Document
- Name
- Pentest and Security Analysis Report for BingX
- Audited By
- Approved By
- Website
- https://bingx.com→
- Changelog
- 25/09/2025 - Preliminary Report
- Changelog
- 24/10/2025 - Final Report
- Platform
- https://bingx.com/en→
- Language
- Java
- Tags
- Pentest, BlackBox
- Methodology
- https://hackenio.cc/pentest_methodology→
Review Scope | |
|---|---|
| Repository | https://play.google.com/store/apps/details?id=pro.bingbon.app&hl=en→ |
| Version | 4.69.5 |
Review Scope
- Version
- 4.69.5
Audit Summary
The system users should acknowledge all the risks summed up in the risks section of the report
System Overview
BingX provides a sophisticated Android-based mobile application that acts as a primary touchpoint for its global user base. The application is designed to deliver a seamless, AI-enhanced trading experience, granting users access to a wide range of financial products and intelligent tools directly from their mobile devices.
Android Application Overview
Key features of the application include:
Core Trading Functionality: The app provides immediate access to spot and USDT-M perpetual futures markets, supporting high-leverage trading. It is designed for ultra-fast order execution, critical for trading volatile memecoins. The interface likely displays real-time price charts, order books, and market data for a vast array of memecoins and other cryptocurrencies.
Portfolio and Asset Management: A central dashboard aggregates the user's portfolio balance across spot and futures accounts. The app facilitates key actions such as deposits and withdrawals. Prompts for engaging with new listings or community initiatives are expected to be prominent.
Security and Transparency Measures: The platform's emphasis on "Industry-leading Security & Asset Transparency" suggests the app includes features related to its Proof of Reserves, allowing users to verify asset backing. Security protocols like Two-Factor Authentication (2FA), anti-phishing codes, and device management are essential components.
Community-Centric Interface: The app is likely designed with a focus on community engagement, providing easy access to new memecoin listings, announcements, and potentially community feeds.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2025-1318 | Application Operates on Rooted Devices and Emulators Without Restriction | accepted | Low | |
| F-2025-1318 | Lack of SSL/TLS Certificate Pinning | fixed | Observation | |
| F-2025-1318 | Absence of User Data Preservation Prompt on Uninstall | fixed | Observation | |
| F-2025-1318 | Exported Services Without Permission Protection | fixed | Observation |
Appendix 1. Severity Definitions
Severity | Description |
|---|---|
Critical | These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm. |
High | These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach. |
Medium | These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention. |
Low | These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation. |
Severity
- Critical
Description
- These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm.
Severity
- High
Description
- These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach.
Severity
- Medium
Description
- These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention.
Severity
- Low
Description
- These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation.
Appendix 2. Scope
The scope of the project includes the following endpoints from the provided repository:
Scope Details | |
|---|---|
| Android | https://play.google.com/store/apps/details?id=pro.bingbon.app&hl=en→ |
| Version | 4.67.1 |
Scope Details
- Version
- 4.67.1