OneKey founder warns older iPhones are unsafe for crypto seed phrases

What happened

The founder of hardware wallet maker OneKey, Yishi Wang, has cautioned cryptocurrency holders against keeping wallet recovery phrases on older iPhones, arguing that chip-level weaknesses in those devices stay exploitable even after a factory reset or with the handset kept offline. The warning was published in an October 31 post and reported by Crypto.news and U.Today.

Wang pointed to two publicly documented exploits that sit in the BootROM, the first code an iPhone runs at startup. The older one, checkm8, became public in 2019 and covers models from the iPhone 4S through the iPhone X. The second, usbliter8, was disclosed in June 2026 and targets Apple's A12 and A13 processors, which power the iPhone XS, the iPhone XR, the iPhone 11 series and the second-generation iPhone SE. Because that startup code is fixed in the processor, ordinary iOS updates cannot replace it.

Carrying out such an attack is not remote work. It requires physical possession of the phone plus specialised equipment, according to the reports. An attacker can place an affected device into Device Firmware Update mode, connect hardware over USB and potentially run unauthorised code before iOS loads. Switching on airplane mode offers no protection, since the technique does not need an internet connection.

For holders who have kept a recovery phrase on one of the affected handsets, Wang's advice is to build an entirely new wallet in a trusted setting and move the assets there. Generating another address from the same recovery phrase would leave the original exposure in place. He added that the iPhone 12 and later are not known to be affected by the two BootROM exploits he discussed.

Why it matters

Using a wiped spare phone as an offline wallet is a familiar practice among self-custody users, who strip unnecessary apps and cut network connections to keep secrets away from online attackers. Wang's argument is that this removes remote risk without addressing someone who gets their hands on the device. Exploiting the BootROM does not by itself hand over a seed phrase: passcodes, encryption and Apple's Secure Enclave still stand in the way, and the danger grows when users pick short passcodes, skip software updates or protect wallet apps with weak passwords. A six-digit numeric passcode offers one million possible combinations, and forensic tools may be able to sidestep the limits that normally slow down guessing. A wallet file extracted with only a weak app password could also be attacked offline. Wang raised the prospect of an "evil maid" scenario, in which a phone left in a hotel room, handed over for inspection or lent for charging is tampered with and returned without any visible sign.

What the data shows

The affected range is unusually wide for a hardware flaw: checkm8 has been public since 2019 and spans the iPhone 4S to the iPhone X, while usbliter8 arrived in June 2026 for A12 and A13 devices. On the defence side, a six-digit passcode yields one million combinations, and Apple's fixes for the ChoiceJacking authentication issue arrived in iOS 18.4. The Singapore cases cited by police involved roughly S$3.5 million in losses.

Background

The comments followed a run of jailbreak demonstrations. At the Hexacon security conference in Paris on October 16, the Calif research team reportedly showed an iPhone 18 Pro running iOS 27.0.1 being jailbroken, bypassing Apple's Memory Integrity Enforcement protections to gain elevated access. Apple shipped iOS 27.2 on October 26 with fixes for several vulnerabilities reportedly used in those demonstrations. Wang later referred to an October 30 claim from Ikotas Labs concerning iOS 27.2 but said the video available publicly was not enough to confirm a jailbreak, and he separated these software attacks from the permanent boot weaknesses in older hardware. He also mentioned ChoiceJacking, a 2025 disclosure in which malicious USB accessories mimic user input and may authorise access to device data; Apple addressed the authentication weakness in iOS 18.4. The warning lands after hardware wallet tampering cases in Singapore, where police reported about S$3.5 million in crypto losses tied to modified Ledger devices containing hidden components built to capture recovery phrases during setup. U.Today noted that dedicated signing devices carry their own risks, including counterfeits, compromised distribution and careless handling of recovery phrases.

What to watch

Two things are worth tracking. The first is whether independent researchers corroborate the October 30 jailbreak claim around iOS 27.2 that Wang declined to confirm from a public video. The second is how Apple responds to continued disclosure work on boot-level and jailbreak techniques, since fixes delivered through iOS updates cannot reach code baked into older processors. For holders, the practical question is whether any recovery phrase has ever sat on a pre-2020 iPhone that left their control, which is the condition Wang treats as grounds for starting over with a new wallet.

Questions readers ask