Ishi Wang, founder of OneKey, has warned cryptocurrency owners against storing wallet seed phrases on older iPhone models, citing chip-level vulnerabilities that remain exploitable even after a factory reset or disconnecting from the internet.
In a message dated October 31, Wang explained that some iPhones released before 2020 contain boot-system vulnerabilities that Apple cannot fix with software updates.
His warning followed recent public demonstrations of iPhone hacks, which once again raised questions about whether it is safe to store cryptocurrency recovery phrases on repurposed smartphones.
Many cryptocurrency owners use old smartphones as offline wallets, deleting unnecessary apps and disabling network connections to protect their personal information from online attacks.
Wang called this approach into question for devices with known BootROM vulnerabilities.
BootROM contains the first instructions executed when an iPhone starts up. Because these instructions are permanently stored in the processor, regular iOS updates cannot replace the affected code.
Two vulnerabilities affecting different generations of Apple devices have been publicly documented.
The earlier vulnerability, known as checkm8, was made public in 2019 and affects iPhones from the 4S through the iPhone X.
The second vulnerability, dubbed usbliter8, was discovered in June 2026. It targets the Apple A12 and A13 processors used in the iPhone XS, XR, iPhone 11 series, and the second-generation iPhone SE.
Researchers have demonstrated that attackers with physical access can manipulate a device’s boot process over a USB connection.
By putting a vulnerable phone into device firmware update mode and connecting specialized hardware to it, an attacker can execute unauthorized code before iOS loads.
Enabling airplane mode does not prevent this type of attack, since internet access is not required to exploit the vulnerability.
