An old iPhone wiped clean and switched to airplane mode still feels like a safe vault — but the flaw lives in the chip itself, below anything a software update can reach.
November 1, 2026 — OneKey founder Yishi Wang has warned cryptocurrency holders against storing wallet seed phrases on an iPhone 11 or any earlier model, saying the devices carry hardware flaws that Apple cannot fix with a software update. The warning, posted on October 31, 2026, challenges a popular habit: wiping an old iPhone, taking it offline, and using it as a homemade vault for recovery words.
Image: An older iPhone beside a glowing processor chip and a padlock warning symbol, illustrating a hardware flaw buried in the phone's boot code. Credit: Red Eye Eagle News / AI illustration.
Editor's Highlight: The point is not that every old iPhone is already compromised — it is that the safety of the "offline old phone" strategy rests on hardware that, for these models, has a known and permanent crack in its very first line of code.
Table of Contents
- The Warning in Plain Terms
- What BootROM Is — and Why It Cannot Be Patched
- Two Flaws, Two Generations of iPhones
- What an Attacker Still Has to Get Past
- What to Do If You Hold Crypto on an Old iPhone
- Bottom Line
- FAQ
- Sources
Key Facts
| Detail | Information |
|---|---|
| Who warned | Yishi Wang, founder of hardware wallet maker OneKey |
| When | Post on October 31, 2026; reported November 1, 2026 |
| Devices affected | iPhone 11 series and earlier models |
| Flaws involved | checkm8 (2019) and usbliter8 (June 2026), both in the BootROM |
| Why it cannot be fixed | BootROM code is burned into the chip; iOS updates cannot rewrite it |
| Attack requirements | Physical access plus specialized USB equipment; not a remote attack |
| Models not known to be affected | iPhone 12 and newer, according to Wang |
| Recommended action | Create new seed phrases on a secure device and transfer assets |
French-language explainer on how forensic tools extract data from phones in physical-access scenarios — the same class of hands-on attack Wang's warning describes. It is not an official Apple or OneKey video.
The Warning in Plain Terms
Many crypto holders keep their recovery words — the seed phrase that can regenerate an entire wallet — on a spare phone. The logic feels sound: remove the apps, disconnect the phone, and the words sit beyond the reach of online thieves.
Wang says that logic breaks down for iPhone 11 and earlier models. Wiping the phone and switching on airplane mode does not remove the exposure, because the weakness is not in an app or the operating system. It is in the chip's startup code.
Newsroom Focus: This is a warning about a specific storage habit, not a claim that funds have already been stolen through these flaws. No theft tied directly to checkm8 or usbliter8 was reported in the coverage of Wang's post.
What BootROM Is — and Why It Cannot Be Patched
BootROM is the first code an iPhone runs when it powers on. It lives in read-only memory baked into the processor during manufacturing, and it hands control to the next stage of the startup chain.
Because that code is fixed in silicon, an iOS update cannot replace it. That is what makes a BootROM flaw permanent: Apple can patch software around it, but it cannot rewrite the flawed code itself.
The practical consequence is stark. A factory reset clears data, and airplane mode cuts the network — but neither touches the BootROM. An attacker who reaches that first stage of startup is operating before iOS and its defenses have even loaded.
Two Flaws, Two Generations of iPhones
Two publicly documented exploits cover different generations of Apple hardware, and together they span from the iPhone 4S to the iPhone 11 line.
The older flaw, checkm8, became public in 2019 and affects iPhones from the 4S through the iPhone X — devices running Apple's A5 to A11 chips. It has been known for years and is widely used in security research and jailbreaking.
The newer flaw, usbliter8, was disclosed in June 2026 and targets Apple's A12 and A13 chips. That brings the iPhone XS, iPhone XR, the entire iPhone 11 series, and the second-generation iPhone SE into scope — phones many owners still consider reasonably current.
| Exploit | Disclosed | Affected models |
|---|---|---|
| checkm8 | 2019 | iPhone 4S through iPhone X |
| usbliter8 | June 2026 | iPhone XS, XR, 11 series, SE (2nd gen) |
| Neither known to affect | — | iPhone 12 and newer |
Tech Analysis: The June 2026 disclosure is what makes this warning new. Checkm8 alone stopped at the iPhone X; usbliter8 extends the same class of permanent, hardware-level risk to the A12 and A13 generation.
What an Attacker Still Has to Get Past
Both exploits require the attacker to physically hold the phone. According to the details Wang shared, the attacker puts the device into DFU mode — Device Firmware Update, a low-level recovery state — and connects specialized USB equipment, allowing unauthorized code to run before iOS loads.
That physical-access requirement sharply limits the risk for most people. This is not an attack that arrives by email, message, or website, and airplane mode offers no protection precisely because the technique never touches a network.
Wang also stressed that reaching the BootROM does not automatically hand an attacker a seed phrase. On models such as the iPhone XS and iPhone 11, the device passcode, file encryption, and Apple's Secure Enclave still stand in the way.
The danger grows when those remaining defenses are weak. A six-digit numeric passcode has only one million possible combinations, and forensic tools may be able to work around the safeguards that normally slow down guessing. Outdated software and weak wallet-app passwords widen the opening further.
Practical Takeaway: The risk is not "your old phone will be hacked." It is "your old phone cannot be made trustworthy again if it leaves your hands." Keep an affected phone under your control, or move the seed phrase off it.
What to Do If You Hold Crypto on an Old iPhone
Wang's core advice is blunt: do not simply generate a new wallet address from the existing seed phrase. A seed phrase is the master key that generates every address in a wallet, so new addresses derived from an exposed phrase still trace back to the same key.
Instead, he recommends creating an entirely new wallet — with a newly generated seed phrase — in a trusted environment, and transferring holdings to it. That advice applies with particular force if an older phone has spent time outside its owner's control.
For anyone still using an affected device, the secondary steps are straightforward:
- Use a long alphanumeric passcode rather than a short numeric one.
- Keep software and wallet apps updated.
- Avoid unfamiliar USB chargers or accessories.
- Consider Apple's Lockdown Mode if you are concerned about targeted attacks.
For longer-term storage, Wang recommends newer, regularly updated devices — the iPhone 12 and later models are not known to be affected — or a dedicated hardware wallet. He also drew a line between this warning and recent software jailbreak demonstrations: those involve flaws Apple can patch, while the BootROM flaws cannot be patched at all.
Bottom Line
OneKey founder Yishi Wang's warning reframes a common crypto habit: an old iPhone wiped clean and kept offline is not the vault many owners believe it is, because checkm8 and usbliter8 live in the chip's unchangeable startup code. The attack still requires physical access and must get past passcodes and the Secure Enclave — but no update will ever close the underlying flaw. What to watch next: whether Apple responds publicly, and whether researchers publish further detail on usbliter8's real-world exploitability.
FAQ
Which iPhones are affected?
According to Wang, the iPhone 11 series and earlier. Checkm8 covers the iPhone 4S through the iPhone X, and usbliter8 covers the iPhone XS, XR, 11 series, and second-generation iPhone SE. The iPhone 12 and newer are not known to be affected.
Can an iOS update fix this?
No. Both flaws sit in the BootROM, the first code the phone runs, which is burned into the processor during manufacturing. Ordinary iOS updates cannot replace that code.
Does wiping the phone or using airplane mode help?
Not against this class of attack. A factory reset clears data and airplane mode cuts network access, but neither changes the BootROM — and the attack works over a USB connection with physical access, not over a network.
Does this mean my crypto is already stolen?
No. Exploiting the BootROM does not automatically reveal a seed phrase. The device passcode, encryption, and Secure Enclave remain barriers, and an attacker still needs physical access and specialized equipment.
Is this the same as the recent iPhone jailbreak news?
No. Wang distinguished the permanent BootROM weaknesses from recent software jailbreak demonstrations, which involve flaws Apple can patch with an update.
Sources
- crypto.news — OneKey founder warns iPhone 11 and older models pose crypto wallet risks: Wang's October 31 post, affected models, attack method, and recommended actions.
- TradingView / CryptoBriefing — OneKey founder warns older iPhones have unpatchable chip vulnerabilities: BootROM explanation, DFU/USB method, and migration advice.
- YouTube (Sylvqin) — How the Police Unlock Your Phone Without Your Passcode (Cellebrite): French-language explainer on physical-access phone data extraction.
- Hero image: original AI-generated illustration / Red Eye Eagle News.
Join the conversation
Comments
Post a Comment