How was AES Encryption cracked on my app? I built an app that used AES encryption with 16 characters Key and IV.  It seems it could easily be hacked, as someone did it in a day.
I feel that I made a few mistakes

Used key &amp; IV which was only plain text length of 16
Key not hashed with SHA-256
It was an Android app ( Xamarin Forms) and I did not obfuscate the app

Can anyone guide me on what went wrong?
[Updates]

The app needs to operate in offline mode. That's why I hardcode keys in the application.
This app is reading information from QR Code encrypted content. An attacker able to create a QR Code with fake information that becomes a valid QR code
If the characters are from $[A..Z]$ and $[0..9]$ then that makes 39 possibilities per character (byte). Then the keyspace will be $39^{16}$ and that is approximately 83-bit. This is space is achievable with supercomputers but not for ordinary people. Therefore, there must be something else around that cracks your system.

Used key &amp; IV which was only plain text length of 16

That is not a good way.

The IV must random, though, your mode of operation is not clear therefore we cannot recommend the exact usage. In short, we can say that a (key,IV) pair must be used only once. You can use Android's secure random to generate the random IV.

For the key, one should go for the diceware or Bip39 to have good strength on the password. The user can still have a longer character than 16 so that at least 128-bit strength is achieved. With the password, the memory-hard password hashing algorithms like Argon2 to reduce the attack capability of the attackers.



Key not hashed with SHA-256

SHA-256 is not a password hashing algorithm we have Scrypt, PBKDF2, and Argon2 for those kinds of problems.

It was an Android app ( Xamarin Forms) and I did not obfuscate the app

This sentence indicates that probably you hardcoded the key into your application. And the attacker resolved the key by getting the package and analyzed the reversed byte code. This is not the correct way to store a cryptographic key.
If you want to communicate with your server use DHKE with your server to create the session key and possibly the IV by using the full exchanged key with HKDF. Then apply AES-GCM or ChaCha20-Poly1305 to achieve the authenticated encryption. In this way, you don't need to store secret keys. You only need the public key of your server. With this, you can achieve, forward secrecy, confidentiality, integrity, and authentication.
If you want to use app-in encryption, then get the password with a good strength from the user and derive the encryption key by using Argon2id.
You may also have the benefit of using the Android-KeyStore if that fits your needs.

updates

[Update] This app is reading information from QR Code encrypted content. An attacker able to create a QR Code with fake information that becomes a valid QR code

As Fgrieu mentioned that you can use a signed QR. To check the signature one only needs a public key.

If the content doesn't need to be encrypted, then there is no need for an encryption key.

If encryption is required, one can either install the key later and store it in the key-store or use a server-client approach so that the device doesn't use the key at all. The client either gets the key temporality from the server, or it can use the server as a decryption oracle while using a secure channel as told above.



[Update] The app needs to operate in offline mode. That's why I hardcode keys in the application

Installing the key later is the solution. You can install the key either manually in Android activity or use a specially designed QR code to read in then store it in the Android Key-Store.