OneKey Founder Warns Against Storing Seed Phrases on Old iPhones
OneKey founder Yishi Wang warns that chip-level BootROM flaws in older iPhones cannot be fixed by iOS updates, making offline phones a risky place for seed phrases if an attacker gets physical access.
A spare iPhone, wiped clean and taken offline, has become a popular makeshift cold wallet among self-custody users. OneKey founder Yishi Wang says that habit rests on a weakness no software update can reach. In an October 31 post, Wang explained that some iPhones released before 2020 contain vulnerabilities in their startup systems that Apple cannot repair through software, and he warned crypto holders against keeping wallet seed phrases on them.
The flaws sit in the BootROM, which holds the first instructions an iPhone executes when it starts. Because the problem lives at the chip level, iOS updates cannot fix it, and neither a factory reset nor cutting the phone off from the internet makes it go away. Think of it as a crack in a foundation poured before the house was built: you can renovate every floor above it and the crack remains.
Two exploits are at issue. Checkm8, public since 2019, affects the iPhone 4S through the iPhone X. A second, usbliter8, was disclosed in June 2026 and targets A12 and A13 chips, found in the iPhone XS, XR, the 11 series and the second-generation SE. Wang advises against trusting iPhone 11-generation and older devices with recovery phrases. He said the iPhone 12 and newer are not known to be affected by either exploit, and he recommended newer, regularly updated devices.
What an attacker needs
The threat is real but bounded. Attackers need physical access and specialized equipment, for instance putting the phone into DFU mode (a low-level recovery state) and connecting it over USB. Airplane mode, or switching off Wi-Fi and cellular, does not prevent this.
A vulnerability also does not automatically hand over a seed phrase. Passcodes, encryption and the Secure Enclave remain real barriers, though short passcodes, outdated software or weak wallet passwords erode them. Wang also raised the evil maid attack, in which someone tampers with a device while its owner is away.
Recommended steps
If a phrase may have been exposed, Wang's advice is to generate a completely new recovery phrase in a trusted setup and move the funds. Deriving another address from the same seed does not help, since the underlying secret is unchanged. Other measures include:
- Keep software updated.
- Use long alphanumeric passcodes.
- Avoid unfamiliar USB chargers or accessories.
- Consider Apple's Lockdown Mode if worried about targeted attacks.
Wang's case for dedicated hardware goes further still: he has previously suggested that even newer iPhones should not be treated as equal to purpose-built signing devices for substantial, long-term holdings. Those devices are not risk-free either, since counterfeit hardware, compromised distribution channels and sloppy recovery-phrase handling can undo them just as surely.
Newer devices and the wider picture
The warning follows recent public demonstrations of iPhone jailbreaks, which have renewed questions about whether repurposed smartphones can safely hold recovery phrases. A Calif team reportedly showed an iPhone 18 Pro jailbreak on iOS 27.0.1 at Hexacon in Paris on October 16, and Apple released iOS 27.2 on October 26. Wang said a video of an October 30 claim by Ikotas Labs about iOS 27.2 was insufficient to confirm it.
Physical tampering is not only a laboratory concern. The warning also lands alongside Singapore police reports of about S$3.5 million in crypto losses involving modified Ledger devices.
For holders, the practical takeaway concerns threat models. Anyone keeping meaningful savings on an old phone, or anyone who might lose one, should treat the hardware generation as part of their security setup rather than an afterthought.
