OneKey founder Yishi Wang has warned cryptocurrency holders against using an iPhone 11 or an older model to store wallet seed phrases, saying the devices carry chip-level flaws that no software update can repair. In a post on October 31, Wang argued that a common piece of crypto folk wisdom — wipe an old iPhone, put it in airplane mode, and use it as an offline vault for recovery words — rests on a false sense of security.
The problem, he said, sits in the BootROM, the first code an iPhone runs when it powers on. Because that code is burned into the processor during manufacturing, Apple cannot rewrite it through an iOS update, and neither a factory reset nor disconnecting the phone from the internet removes the exposure.
Two flaws, two generations of iPhones
Wang pointed to two publicly documented BootROM exploits. The first, checkm8, has been public since 2019 and affects models from the iPhone 4S through the iPhone X. The second, usbliter8, was disclosed in June 2026 and targets Apple's A12 and A13 chips, which power the iPhone XS, XR, the iPhone 11 line, and the second-generation iPhone SE.
Both attacks require the attacker to physically hold the phone. According to the details Wang shared, the attacker forces the device into Device Firmware Update mode — a low-level recovery state — and connects a specialised USB tool, allowing unauthorised code to run before iOS ever loads. Airplane mode offers no protection, because the technique never touches a network.
Why an offline phone is not automatically a safe vault
Wang was careful to draw a line between a vulnerable phone and an exposed wallet. Reaching the BootROM does not automatically hand an attacker a seed phrase. On models such as the iPhone XS and iPhone 11, the device passcode, file encryption, and Apple's Secure Enclave still stand in the way.
The risk grows, he said, when those defences are weak: short numeric passcodes, outdated software, or weak passwords protecting wallet apps. A six-digit numeric passcode has only one million possible combinations, and forensic tools may be able to work around the safeguards that normally slow down guessing. He also raised the “evil maid” scenario, in which someone tampers with a device while its owner is away — an attack the owner might never notice, since the phone can be returned apparently untouched.
What owners should do instead
For anyone who has stored recovery words on an affected device, Wang's advice is blunt: do not simply generate a new address from the same phrase. Because a seed phrase is the master key that generates every address in a wallet, new addresses derived from an exposed phrase still trace back to the same key.
Instead, he recommends creating an entirely new wallet — with a fresh recovery phrase — in a trusted environment, and moving assets to it. Dedicated hardware wallets or newer, regularly updated handsets are the safer options, he said, noting that the iPhone 12 and later models are not known to be affected by either BootROM exploit. For holders still using an older iPhone day to day, the message is narrower but clear: the phone may still be fine for calls and apps, but it should no longer be trusted as a vault for the keys to your crypto.
