Q2 2026 Security & Compliance Report67 incidents, $764M in losses, 88% from operational failures.
Get the report →
BingX logo

BingX

Audit name:

[PT] BingX | iOS | Sep2025

Date:

Oct 31, 2025

Table of Content

→Introduction
→Audit Summary
→System Overview
→Findings
→Appendix 1. Severity Definitions
→Appendix 2. Scope
→Disclaimer

Want a comprehensive audit report like this?

Introduction

We express our gratitude to the BingX team for the collaborative engagement that enabled the execution of this Pentest.

Document

NamePentest and Security Analysis Report for BingX
Audited By
Approved By
Websitehttps://bingx.com/en→
Changelog29/09/2025 - Preliminary Report
Changelog05/10/2025 - Final Report
LanguageSwift
TagsiOS - Mobile Application
Methodologyhttps://hackenio.cc/pentest_methodology→
PlatformiOS

Review Scope

App Storehttps://apps.apple.com/ua/app/bingx-buy-bitcoin-crypto/id1500217666?l=en-GB→
Version4.67.0
Retest Version4.69.5

Protect your dApp with insights like these.

Audit Summary

6Total Findings
0Resolved
6Accepted
0Mitigated

The system users should acknowledge all the risks summed up in the risks section of the report

System Overview

Bing provides a sophisticated iOS mobile application that serves as a primary touchpoint for its global user base. The app is designed to deliver a seamless, AI-enhanced trading experience, granting users access to a wide range of financial products and intelligent tools directly from their iPhone.

Key features of the application include:

  • Core Trading Functionality: The app provides real-time access to spot and UST-M perpetual futures markets with support for high-leverage trading. It is optimized for ultra-low-latency order execution, which is critical for users trading highly volatile assets such as memecoins. The interface likely integrates live price charts, order books, and market depth visualizations tailored for mobile.

  • Portfolio and Asset Management: A centralized dashboard displays the user's balance across both spot and futures accounts. Users can easily perform key actions such as deposits, withdrawals, and internal transfers. The app likely includes dynamic prompts for engaging with new listings and ecosystem updates.

  • Security and Transparency Measures: Bing emphasizes “industry-leading security and asset transparency,” suggesting that the iOS app includes built-in support for Proof of Reserves, allowing users to verify asset holdings. Security features likely include Face ID / Touch ID integration, Two-Factor Authentication (2FA), anti-phishing phrases, and device management options within the app settings.

  • Community-Centric Interface: The iOS app is likely designed to encourage user engagement with memecoin communities, highlighting new token listings, platform announcements, and possibly integrated community feeds or forums.

Findings

F-2025-1320 Lack of Restriction on Third-Party Keyboards
Status
accepted
Severity

Low
F-2025-1319 Lack of Anti-Hook and Anti-Debug Mechanism
Status
accepted
Severity

Low
F-2025-1319Insecure App Transport Security (ATS) Settings
Status
accepted
Severity

Low
F-2025-1320No Strong Encryption Declared in App Configuration
Status
accepted
Severity

Observation
F-2025-1320Use of Default Data Protection Class
Status
accepted
Severity

Observation
F-2025-1319Stack Smashing Protection Not Enforced
Status
accepted
Severity

Observation
Code
―
Title
Status
Severity
F-2025-1320 Lack of Restriction on Third-Party Keyboards
accepted

Low
F-2025-1319 Lack of Anti-Hook and Anti-Debug Mechanism
accepted

Low
F-2025-1319Insecure App Transport Security (ATS) Settings
accepted

Low
F-2025-1320No Strong Encryption Declared in App Configuration
accepted

Observation
F-2025-1320Use of Default Data Protection Class
accepted

Observation
F-2025-1319Stack Smashing Protection Not Enforced
accepted

Observation
1-6 of 6 findings

Uncover findings like these to secure your project.

Appendix 1. Severity Definitions

Severity

Description

Critical
These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm.

High
These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach.

Medium
These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention.

Low
These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation.

  • Severity

    Critical

    Description

    These issues present a major security vulnerability that poses a severe risk to the system. They require immediate attention and must be resolved to prevent a potential security breach or other significant harm.

    Severity

    High

    Description

    These issues present a significant risk to the system, but may not require immediate attention. They should be addressed in a timely manner to reduce the risk of the potential security breach.

    Severity

    Medium

    Description

    These issues present a moderate risk to the system and cannot have a great impact on its function. They should be addressed in a reasonable time frame, but may not require immediate attention.

    Severity

    Low

    Description

    These issues present no risk to the system and typically relate to the code quality problems or general recommendations. They do not require immediate attention and should be viewed as a minor recommendation.

Appendix 2. Scope

The scope of the project includes the following:

Assets in Scope

iOS - iOS

Disclaimer