OneKey founder warns that iPhone models from 2011 and earlier may pose risks to encrypted wallets

OneKey Founder Yishi Wang warns cryptocurrency holders not to store their wallet seed phrases on older iPhone devices, as there are chip-level security vulnerabilities that can still be exploited even after restoring factory settings or disconnecting from the internet.

• OneKey founder Yishi Wang claims that the older iPhone has hardware vulnerabilities, and updates to iOS cannot fix these issues.
• checkm8 affects models from iPhone to iPhone X, while usbliter8 impacts iPhone, XS, XR, iPhone 11, as well as the second-generation iPhone and SE models.
• Attackers require physical access and specialized equipment, but passwords and Secure Enclave provide additional protection.
• For users who have recovery phrases stored on affected devices, it is recommended to generate new phrases and transfer the assets.

In a post on October 31, Wang explained that some iPhone released before 2020 contained vulnerabilities in the startup system, and Apple was unable to fix these issues through software updates.

His warning came after the recent public demonstration of iPhone's "jailbreak." These demonstrations have once again raised questions from the outside world about whether it is still safe to save cryptocurrency recovery phrases on refurbished phones.

OneKey founder points out an irreparable iPhone vulnerability

Many cryptocurrency holders use old smartphones as offline wallets, deleting unnecessary applications and turning off network connections to keep their private information safe from online attackers.

Wang questions whether this approach is applicable to devices with known BootROM vulnerabilities.

BootROM contains the first set of instructions that are executed when iPhone starts. Since these instructions are permanently stored in the processor, ordinary updates to iOS cannot replace the affected code.

Two vulnerabilities that are currently publicly recorded affect different generations of Apple devices.

The earlier vulnerability was named checkm8 and was made public in 2019. Its impact range extended from iPhone 4S to iPhone X.

The second vulnerability is named usbliter8 and was disclosed in June 2026. It targets Apple's A12 and A13 processors, including the iPhone XS XR iPhone 11 series, as well as the second-generation iPhone SE.

Researchers demonstrated that attackers with physical access rights can manipulate the startup process of devices through USB.

By placing the affected phones in device firmware update (DFU) mode and connecting them to a specialized device, attackers may execute unauthorized code before (iOS) is loaded.

Enabling flight mode does not prevent such attacks, as this vulnerability does not require an internet connection.

Physical contact does not equate to automatically obtaining a mnemonic phrase.

Although these vulnerabilities are permanent, Wang emphasizes that exploiting the BootROM vulnerability does not automatically grant attackers access to encrypted wallets.

On devices such as iPhone, XS, and iPhone 11, passwords, encryption, and Apple's Secure Enclave provide an additional layer of security.

The risk becomes higher when users use shorter passwords, outdated software, or weak passwords to protect their wallet applications.

There are a total of 1 million possible combinations for a six-digit password. Depending on the device and available vulnerabilities, forensic tools may attempt to bypass the mechanisms that usually limit the number of password guessing attempts.

There is another potential weakness in wallet applications.

If an attacker manages to extract an encrypted wallet file that is only protected by a weak application password, then that file may be subject to offline password guessing attacks.

Wang also mentioned a type of " evil maid " attack, where someone secretly intervenes with the device when the owner is not present.

A phone that is left in a hotel room, handed over to others for inspection, or lent to someone else for charging can all provide an opportunity for physical tampering.

After the device is returned, the owner may not notice any abnormalities.

Recent jailbreak demonstrations have raised more concerns

Comments related to Wang appeared after several jailbreak demonstrations involving newer Apple devices.

On October 16th, at the Hexacon Security Conference held in Paris, the Calif research team reportedly demonstrated a jailbreak of iPhone version 18 running iOS 27.0.1.

It is alleged that this demonstration bypassed Apple's Memory Integrity Enforcement protection, allowing researchers to gain higher levels of access.

Apple released iOS 27.2 on October 26, fixing several vulnerabilities that were reportedly exploited in those demonstrations.

Wang subsequently mentioned Ikotas Labs's statement on iOS being 27.2 on October 30th, but indicated that the publicly available videos were not sufficient to confirm the related jailbreak.

He distinguished these recent software attacks from the permanent BootROM vulnerabilities that affect older devices.

Another concern comes from ChoiceJacking, a technology that was disclosed in 2025. Malicious USB components can impersonate user input and may grant access to device data.

Apple has fixed the relevant authentication vulnerability in iOS 18.4.

OneKey It is recommended that users replace the affected wallet seeds.

For cryptocurrency holders who have already stored their recovery phrases on the affected iPhone, Wang recommends creating a brand-new wallet in a trusted environment.

If the original phrase has already been leaked, simply generating another address using the same recovery phrase will not solve the problem.

He suggests transferring cryptocurrencies to wallets controlled by newly generated recovery phrases, especially in cases where the old phone has been out of the owner's control.

Users should keep their software up to date, choose longer alphanumeric passwords, and avoid connecting their devices to unfamiliar USB chargers or accessories.

For those concerned about targeted attacks, Wang suggests considering using Apple's Lockdown Mode, which limits certain device functions and connections.

This warning appears following recent cases of hardware wallet tampering in Singapore. Local police reported that modified Ledger devices were involved, resulting in a loss of cryptocurrency worth approximately 3.5 million Singapore dollars.

Earlier investigations revealed that there was a hidden wallet component within the device, which was capable of capturing recovery phrases during the device setup process.

Wang indicates that the iPhone 12 and later models are not currently considered to be affected by the two BootROM vulnerabilities he mentioned. He recommends using updated devices that are regularly upgraded for storing cryptocurrencies.