Old iPhones May Not Be Safe as Crypto Cold Wallets, OneKey Founder Warns
Using an older iPhone as an offline cryptocurrency wallet may expose digital asset holders to security risks that cannot be eliminated by deleting personal data or disconnecting the device from the internet, according to OneKey founder Yishi Wang.
Wang issued the warning after several public demonstrations of iPhone jailbreak techniques emerged over the past two weeks. He highlighted potential hardware-level vulnerabilities affecting the iPhone 11 and earlier models, including the second-generation iPhone SE, raising concerns about the security of devices repurposed for cryptocurrency cold storage.
The central issue involves vulnerabilities in Apple's BootROM, the low-level firmware responsible for initiating the device's startup process. Unlike conventional software weaknesses, these flaws cannot be resolved through regular iOS updates, meaning that installing the latest available operating system does not necessarily eliminate the underlying security exposure.
Why Airplane Mode and Factory Resets May Not Be Enough
Older smartphones are sometimes repurposed as cold wallets because they can be kept offline and separated from devices used for everyday internet access. This approach is intended to reduce exposure to remote attacks and protect private cryptocurrency keys from online threats.
However, Wang's warning challenges the assumption that an iPhone becomes sufficiently secure for cold storage simply by wiping its contents and enabling airplane mode.
According to Coin Bureau the security concern he outlined, BootROM vulnerabilities exist below the operating system level. Consequently, removing applications, resetting the device or disabling wireless connectivity does not address the underlying hardware-related weaknesses.
This distinction is particularly important for cryptocurrency holders because the security of a cold wallet depends on protecting the private keys that authorize transactions. If an attacker gains access to the device at a sufficiently privileged level, the isolation provided by conventional offline settings may not offer the protection users expect.
The Risk of an Evil Maid Attack
One of the scenarios highlighted by Wang is known as an "evil maid" attack. It involves an attacker gaining temporary physical access to a device without the owner's knowledge.
For example, someone could access an iPhone while its owner is away or after borrowing the device. The attacker may attempt to compromise its security before returning it. The phone could subsequently appear normal, leaving the owner unaware that its integrity may have been affected.
This type of threat is particularly relevant to cryptocurrency storage because users may assume that a device kept in a private location remains secure as long as it is not connected to the internet.
Specialized USB Tools Could Exploit Pre-Boot Vulnerabilities
Another concern involves the use of specialized USB equipment to execute code before iOS begins running. According to the warning, an attacker could potentially exploit the BootROM vulnerabilities during the device's startup process.
Importantly, this scenario does not require an internet connection. That means conventional precautions focused on disabling Wi-Fi or cellular connectivity may not be sufficient to prevent this particular category of attack.
The warning does not establish that every older iPhone has been compromised or that all devices are equally exposed. However, it highlights a security limitation that cryptocurrency holders should consider before relying on aging Apple hardware to protect valuable digital assets.
With the identified BootROM flaws affecting the iPhone 11 and earlier models, including the second-generation SE, the key concern is that an offline device is not automatically a secure cold wallet when its underlying hardware remains vulnerable.
Writer: Victoria HaleTechnology & Blockchain WriterVictoria Hale writes about blockchain technology, digital infrastructure, and the intersection of emerging technologies with finance. Her articles explore how new protocols and systems are shaping the evolving digital economy.She prioritises clarity and accuracy when explaining technical developments to a general audience.
Check out other news and articles on Google News
Disclaimer:
The articles on Hokanews are here to keep you updated on the latest buzz in crypto, tech, and beyond—but they’re not financial advice. We’re sharing info, trends, and insights, not telling you to buy, sell, or invest. Always do your own homework before making any money moves.
Hokanews isn’t responsible for any losses, gains, or chaos that might happen if you act on what you read here. Investment decisions should come from your own research—and, ideally, guidance from a qualified financial advisor. Remember: crypto and tech move fast, info changes in a blink, and while we aim for accuracy, we can’t promise it’s 100% complete or up-to-date.