OneKey crypto wallet founder Yishi Wang has warned digital asset holders against storing recovery phrases or seed phrases on older iPhone models. This warning specifically applies to the iPhone 11 and all earlier models released before 2020.
Some users opt to repurpose old smartphones as offline cold storage (air-gapped wallets) simply by disconnecting from the internet. This practice is considered risky due to permanent security vulnerabilities rooted directly at the chip level. This fundamental issue does not stem from the operating system, but rather from the earliest hardware layer.
Hardware Vulnerabilities That Bypass Airplane Mode
The flaw is rooted in the BootROM, the portion of memory that executes initial instructions as soon as the phone processor is powered on. Because it is permanently etched into the physical chip, neither iOS software updates nor factory resets can patch vulnerabilities in this sector.
Two primary BootROM exploits highlighted include checkm8 and usbliter8. Checkm8 was published in 2019 for devices ranging from iPhone 4S to iPhone X. Meanwhile, usbliter8 was disclosed in June 2026, targeting the A12 and A13 Bionic chips found in the iPhone XS, iPhone XR, iPhone 11, and the second-generation iPhone SE.
An attacker with physical access to the device can place the phone into Device Firmware Update (DFU) mode. Over a USB cable connection, the attacker can execute unauthorized code before the iOS operating system is even loaded into memory.
Enabling airplane mode does nothing to prevent this attack vector. BootROM exploitation occurs via a physical USB cable connection, meaning the breach requires no internet connection whatsoever.
Evil Maid Scenarios and Weak Passcode Threats
Wang highlighted the threat of evil maid attack scenarios, where physical tampering occurs when a device is left unattended by its owner. This risk lurks when a phone is left in a hotel room, passing through customs inspections, or lent to someone else for battery charging.
The device’s built-in Secure Enclave module and hardware encryption system do remain functional. Nonetheless, forensic tools leveraging BootROM vulnerabilities can attempt to bypass brute-force passcode rate limiting.
Bypassing rate limits poses a tangible threat to devices with simple protection. A standard 6-digit numeric passcode has only 1 million possible combinations. If the wallet application passcode is also weak, encrypted wallet files risk being cracked without needing to connect to the internet.
Concerns over mobile device security intensified following a demonstration by the Calif team at the Hexacon Paris conference on Oct. 16, 2026, which exploited iOS 27.0.1 on an iPhone 18 Pro. Apple subsequently released the iOS 27.2 update on Oct. 26, 2026, to patch the vulnerability in the operating system.
For crypto asset holders looking to repurpose used phones into self-custody vaults, simply turning off wireless connections does not automatically guarantee security. As long as vulnerabilities remain permanently etched in physical chips, older devices continue to pose risks whenever they leave their owners’ hands.
Reported via crypto.news.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
