Key Highlights
- OneKey founder Yishi cautioned that wiping an older iPhone and keeping it offline does not make it a secure long-term storage device for crypto seed phrases.
- The checkm8 BootROM vulnerability affects iPhone 4S through iPhone X, while the usbliter8 exploit covers the iPhone XS, XR, iPhone 11 series, and second-generation SE.
- Physical access and a connection through a custom USB device can allow attackers to execute code before iOS loads, making airplane mode ineffective against this attack method.
OneKey founder Yishi Wang has warned that wiping an older iPhone, placing it in airplane mode, and using it solely to store a cryptocurrency seed phrase may not provide the security many users expect. His warning focuses on unpatchable hardware vulnerabilities affecting certain iPhone models.
In a post on X on Saturday, Yishi said recent public jailbreaks of newer iPhones had drawn attention, but the more relevant risk for crypto holders involves devices from the iPhone 11 and earlier generations.
On October 16, the Calif research team demonstrated a jailbreak of an iPhone 18 Pro running iOS 27.0.1 at the Hexacon conference in Paris. The jailbreak reportedly survived a reboot, achieved root access, and bypassed MIE, Apple’s hardware-based memory protection introduced with the A19 chip. The presentation also demonstrated single-click attack vectors through Signal and iMessage.
A week later, the team reported jailbreaking the newly released iPhone Duo.
Apple released iOS 27.2 on October 26, and Calif stated that most of the bugs used in those demonstrations had been addressed. On October 30, Ikotas Labs, winners of a recent Pwn2Own contest, claimed to have jailbroken iOS 27.2. However, the supporting video showed limited indicators, leaving the claim unverified.
Yishi said users of newer devices that receive timely software updates did not need to take special precautions beyond installing the latest available iOS version.
Hardware risks on older iPhone models
The primary concern involves iPhones used as offline seed-phrase storage. Devices from the iPhone 4S through iPhone X contain the checkm8 BootROM vulnerability, publicly documented since 2019. In June, the usbliter8 exploit was published, covering the iPhone XS, XR, the 11 series, and the second-generation SE.
The BootROM is factory-burned code that cannot be altered by software updates. Exploitation requires physical access: the device is placed into DFU mode and connected to a custom USB board, such as a low-cost Raspberry Pi Pico. Code can then run before iOS loads. Airplane mode does not protect against this attack method because the exploit relies on physical access rather than a wireless connection.
On models such as the XS and 11, the BootROM issue alone does not automatically expose a seed phrase, because the passcode and Secure Enclave remain barriers. However, common user practices, short numeric passcodes, outdated iOS versions containing known vulnerabilities, or weak wallet-app passwords reduce those barriers.
Forensic tools may leverage related bugs to attempt passcode recovery. If a wallet application encrypts the seed with only a short password, an attacker who extracts the encrypted file can attempt offline brute-force attacks without rate limits.
Older iOS versions also remain exposed to ChoiceJacking, a 2025 technique in which a malicious charger can impersonate a keyboard and approve data-access prompts. Apple addressed that specific issue in iOS 18.4.
These physical-access scenarios are known in security research as evil-maid attacks. A device left unattended in a hotel room, subjected to a security inspection, or lent for charging can be modified without leaving visible signs of interference.
Connection to broader mobile threats
The warning comes amid heightened attention to mobile threats targeting cryptocurrency users. Google’s Threat Intelligence Group recently detailed an operational iPhone exploit kit known as Coruna, also tracked as CryptoWaters on March 4, 2026.
The kit, originally associated with sophisticated surveillance capabilities, has been observed in use against ordinary cryptocurrency holders.
Coruna uses a different attack method from the BootROM vulnerabilities discussed by Yishi. However, both cases highlight the risks of using mobile devices to store or access high-value digital assets.
Security recommendations for crypto holders
Yishi recommended that users check the model of any iPhone holding a seed phrase and move those credentials off devices from the iPhone 11 generation or earlier.
He also advised users to generate an entirely new seed phrase in a trusted environment and transfer their assets to wallets associated with the new seed. Creating new addresses under an existing seed would not address the underlying risk.
Other recommendations include:
- Migrating funds promptly if a device has been outside the owner’s control.
- Keeping daily-use devices updated to the latest available iOS version.
- Using long alphanumeric passcodes and stronger wallet-app passwords.
- Avoiding unknown chargers and public USB ports.
- Considering Lockdown Mode for devices holding high-value assets.
- Treating offers of jailbreak tools or configuration profiles as potential malware.
Yishi said no public BootROM exploit was known for the iPhone 12 or later models. Software updates remain an important security measure for those devices when new vulnerabilities are identified.
Also Read: Binance Targets November 1 Withdrawal Reopening After 90% Replenishment