OneKey Founder Warns Older iPhones May Expose Crypto Wallet Seed Phrases to Security Risks

Older Apple iPhone models potentially affected by BootROM vulnerabilities that could create security risks for cryptocurrency seed phrase storage.

Older iPhones may remain vulnerable to security attacks even after a factory reset, potentially creating risks for cryptocurrency users who rely on the devices to store wallet seed phrases offline. OneKey founder Yishi has warned that several generations of Apple smartphones contain hardware-level vulnerabilities that cannot be eliminated through conventional iOS software updates.

The warning challenges the assumption that an old iPhone becomes a secure offline storage device simply by erasing its contents, enabling airplane mode and disconnecting it from the internet. According to Wu Blockchain Yishi, certain vulnerabilities affect the devices' underlying hardware and may remain exploitable regardless of whether the operating system has been updated or the phone has been reset.

Two BootROM Vulnerabilities Affect Older iPhone Models

Yishi identified two vulnerabilities affecting different generations of Apple devices: checkm8 and usbliter8. The checkm8 vulnerability affects iPhone models ranging from the iPhone 4S through the iPhone X, while usbliter8 affects the iPhone XS, iPhone XR, iPhone 11 series and the second-generation iPhone SE.

Both vulnerabilities operate at the BootROM level, which is associated with the hardware's initial startup process. Because the weaknesses exist below the operating system layer, they cannot be permanently addressed through standard iOS updates.

The security implications are particularly relevant to cryptocurrency holders who use older smartphones as offline repositories for wallet recovery information. Seed phrases typically provide the credentials needed to restore access to cryptocurrency wallets, making their confidentiality essential for protecting digital assets.

Yishi cautioned that enabling airplane mode does not eliminate the identified risks. Attackers who obtain physical access to an affected device and possess specialized tools may be able to exploit the vulnerabilities through its USB connection. Consequently, disconnecting an older iPhone from wireless networks does not necessarily make it resistant to hardware-level attacks.

Secure Enclave Provides an Additional Layer of Protection

However, the vulnerabilities do not automatically mean that attackers can directly retrieve cryptocurrency seed phrases from every affected device.

Yishi clarified that, on models such as the iPhone XS and iPhone 11, checkm8 and usbliter8-related concerns do not independently provide direct access to stored seed phrases. Device passcodes and Apple's Secure Enclave provide additional security protections that remain relevant when assessing the actual exposure.

The Secure Enclave is a dedicated security component designed to protect sensitive information and support cryptographic operations. Its presence means that markets exploiting a BootROM vulnerability should not automatically be interpreted as gaining unrestricted access to all protected data on an iPhone.

This distinction is important for cryptocurrency users because hardware vulnerabilities, physical device access and the ability to extract protected wallet information represent different levels of security exposure.

OneKey Founder Recommends Moving to Newer Devices

To reduce potential exposure, Yishi recommended that users of affected iPhones generate entirely new wallet seed phrases in a trusted environment and transfer their cryptocurrency holdings to wallets associated with the newly generated recovery credentials.

He also advised users to move away from vulnerable older devices, switch to newer hardware, keep software updated and adopt stronger passwords.

For cryptocurrency holders, the warning underscores an important distinction between keeping a device offline and ensuring that its underlying hardware is secure. A factory reset and airplane mode may reduce certain forms of exposure, but they cannot remove vulnerabilities embedded in a device's original hardware.

The affected models span multiple generations of Apple's smartphones, from the iPhone 4S through the iPhone 11 series, as well as the second-generation iPhone SE. Users relying on these devices for offline seed phrase storage should therefore reconsider their security arrangements and follow the precautions outlined by the OneKey founder.

Writer: Victoria Hale
Technology & Blockchain Writer

Victoria Hale writes about blockchain technology, digital infrastructure, and the intersection of emerging technologies with finance. Her articles explore how new protocols and systems are shaping the evolving digital economy.

She prioritises clarity and accuracy when explaining technical developments to a general audience.

Check out other news and articles on Google News

Disclaimer:

The articles on Hokanews are here to keep you updated on the latest buzz in crypto, tech, and beyond—but they’re not financial advice. We’re sharing info, trends, and insights, not telling you to buy, sell, or invest. Always do your own homework before making any money moves.
Hokanews isn’t responsible for any losses, gains, or chaos that might happen if you act on what you read here. Investment decisions should come from your own research—and, ideally, guidance from a qualified financial advisor. Remember: crypto and tech move fast, info changes in a blink, and while we aim for accuracy, we can’t promise it’s 100% complete or up-to-date.