Cake Wallet iOS PIN Bypass Fixed in Version 6.5.2

Version 6.5.2 fixes a lock-screen flaw that could reveal transaction details to someone holding an unlocked iPhone. The problem appeared when Cake Wallet’s built-in browser stayed open as the user switched away from the app and returned.

The security advisory, published November 4, 2026, lists iOS versions through 6.5.0 as affected. It assigns Low severity, with a CVSS score of 2.4 out of 10. This report concerns local access to information, not a remote wallet takeover.

How the Cake Wallet iOS PIN bypass worked

A user could enter their PIN, open a transaction, and follow its block explorer link. That link showed a web page inside the wallet. After leaving the browser open and switching to another app, returning could reveal the page without a fresh PIN prompt.

The recorded test used version 6.4.0 on an iPhone 16 Pro Max running iOS 26.6. A four-digit PIN was set, with “Require PIN after” on “Always.” Biometrics, screenshot protection, and the duress PIN were disabled.

The advisory describes readable transaction data. It does not establish stolen funds or leaked recovery phrases.

What version 6.5.2 changed

The release notes identify the advisory as fixed and describe improvements to PIN and two-factor authentication handling. The relevant code change opens external links outside the wallet, including links to transaction explorers.

The developer’s explanation identifies the browser overlay as the problem. While it covered the app, the events needed to trigger authentication did not reach the underlying interface. Moving those links into an external browser allows the lock screen to appear when the user returns. This is a change to how the application handles links and locks, not to Monero’s transaction rules.

Why blockchain privacy cannot protect an open screen

Monero protects information recorded on its blockchain. For example, stealth addresses give incoming payments unique destinations that cannot be linked to the recipient’s published address by simply reading the chain. A wallet still needs to show its owner useful details about those payments.

Someone looking at that screen has a different source of information. They can see which transaction the device’s user was viewing, without breaking the cryptography that protects the public record. Think of a private message left open on a shared desk. The message service’s encryption cannot hide words already visible to the person standing beside it.

Our guide to limiting identity exposure explains how information outside a blockchain can connect activity to a person. That distinction helps explain why a local privacy leak deserves attention even without evidence of a theft.

Update the wallet and check your locks

Install the current release through Cake Wallet’s official distribution channel. Check the installed version afterward. Version 6.5.2 contains this fix, but the project’s security policy says only the latest release for each platform is supported. Keeping updates enabled matters beyond this particular incident.

After updating, review the wallet’s lock settings and try a simple check on your own device: unlock the wallet, open an explorer link, switch away, then return. Confirm that authentication appears as expected for your chosen timeout. Treat this as a check of the behaviour you rely on, not proof that every security feature has been tested.

Protect the device itself too. Use a passcode that other people do not know, and lock the screen before leaving it unattended. Apple’s passcode guidance explains how longer codes improve resistance to guessing and how to choose a custom alphanumeric code. The phone’s passcode and a wallet PIN serve separate purposes.

Never send your recovery phrase to someone offering update assistance. Cake’s support guidance explicitly says not to share a seed, including with support staff. A request for those words is not part of installing a routine security update.