OneKey founder Yishi Wang has warned cryptocurrency holders against storing wallet seed phrases on older iPhones, citing chip-level security vulnerabilities that remain exploitable even after a factory reset or disconnection from the internet.
Summary
- OneKey founder Yishi Wang warns that older iPhones have hardware vulnerabilities that iOS updates cannot fix.
- Checkm8 affects iPhone 4S through iPhone X, while usbliter8 affects iPhone XS, XR, 11 and second-generation SE models.
- Attackers need physical access and specialized equipment, while passcodes and the Secure Enclave provide additional protection.
- Users storing recovery phrases on affected devices are advised to generate new phrases and transfer their assets.
In an October 31 post, Wang explained that some iPhones released before 2020 contain vulnerabilities in their startup systems that Apple cannot repair through software updates.
His warning follows recent public demonstrations of iPhone jailbreaks, which have renewed questions about whether repurposed smartphones can safely hold cryptocurrency recovery phrases.
OneKey founder identifies unpatchable iPhone vulnerabilities
Many cryptocurrency holders use older smartphones as offline wallets, removing unnecessary applications and disabling network connections to keep their private information away from online attackers.
Wang questioned that approach for devices carrying known BootROM vulnerabilities.
The BootROM contains the first instructions executed when an iPhone starts. Because those instructions are permanently stored in the processor, ordinary iOS updates cannot replace the affected code.
Two publicly documented exploits affect different generations of Apple devices.
The older vulnerability, known as checkm8, became public in 2019 and affects iPhones ranging from the 4S through the iPhone X.
A second exploit, called usbliter8, was disclosed in June 2026. It targets Apple’s A12 and A13 processors, including the iPhone XS, XR, iPhone 11 series and second-generation iPhone SE.
Researchers demonstrated that attackers with physical access could manipulate the device’s startup process through a USB connection.
By placing an affected phone into Device Firmware Update mode and connecting specialized equipment, an attacker may execute unauthorized code before iOS loads.
Turning on airplane mode does not prevent this type of attack because the exploit does not require internet access.
Physical access does not automatically reveal seed phrases
Although the vulnerabilities are permanent, Wang stressed that exploiting the BootROM does not automatically give an attacker access to cryptocurrency wallets.
On devices such as the iPhone XS and iPhone 11, passcodes, encryption and Apple’s Secure Enclave provide additional security barriers.
The danger becomes more serious when users rely on short passcodes, outdated software or weak passwords protecting their wallet applications.
A six-digit numeric passcode has one million possible combinations. Depending on the device and available exploits, forensic tools may attempt to bypass restrictions that normally limit password guessing.
Wallet applications present another potential weakness.
If an attacker manages to extract an encrypted wallet file protected only by a weak application password, the file may be vulnerable to offline password-guessing attempts.
Wang described another concern involving an “evil maid” attack, in which someone secretly interferes with a device while its owner is absent.
A phone left unattended in a hotel room, handed over for inspection or borrowed for charging could provide an opportunity for physical tampering.
The owner might notice nothing unusual when the device is returned.
Recent jailbreak demonstrations raise further concerns
Wang’s comments followed several jailbreak demonstrations involving newer Apple devices.
At the Hexacon security conference in Paris on October 16, the Calif research team reportedly demonstrated an iPhone 18 Pro jailbreak running iOS 27.0.1.
The demonstration reportedly bypassed Apple’s Memory Integrity Enforcement protections and allowed the researchers to obtain elevated access.
Apple released iOS 27.2 on October 26, addressing several vulnerabilities reportedly used in those demonstrations.
Wang subsequently mentioned an October 30 claim from Ikotas Labs involving iOS 27.2, but said the publicly available video was insufficient to confirm the reported jailbreak.
He distinguished these recent software-related attacks from the permanent BootROM weaknesses affecting older devices.
Another concern involves ChoiceJacking, a technique disclosed in 2025 that allows malicious USB accessories to imitate user input and potentially authorize access to device data.
Apple addressed the relevant authentication weakness in iOS 18.4.
OneKey advises users to replace compromised wallet seeds
For cryptocurrency holders who have stored recovery phrases on affected iPhones, Wang recommends creating entirely new wallets in a trusted environment.
Simply generating another address from the existing recovery phrase would not resolve the problem if the original phrase had already been exposed.
He advised transferring cryptocurrency holdings to wallets controlled by newly generated recovery phrases, particularly when an older phone had spent time outside its owner’s control.
Users should maintain updated software, choose longer alphanumeric passcodes and avoid connecting devices to unfamiliar USB chargers or accessories.
For people concerned about targeted attacks, Wang recommended considering Apple’s Lockdown Mode, which restricts certain device functions and connections.
The warning follows recent hardware wallet tampering cases in Singapore, where police reported approximately S$3.5 million in cryptocurrency losses involving modified Ledger devices.
Earlier investigations identified hidden wallet components capable of capturing recovery phrases during device setup.
Wang said iPhone 12 and newer models are not known to be affected by the two BootROM exploits discussed in his warning. He recommended using newer, regularly updated devices for cryptocurrency storage.
