OneKey founder Yishi Wang has warned cryptocurrency holders against storing wallet recovery phrases on older iPhones, citing hardware-level vulnerabilities that cannot be repaired through conventional iOS software updates. In an October 31, 2026 post on X, Wang identified two publicly documented BootROM exploits affecting devices from the iPhone 4S through the iPhone 11 series, including certain second-generation iPhone SE models. The warning challenges the practice of repurposing older smartphones as offline cryptocurrency wallets by performing a factory reset, disabling network connectivity and storing recovery credentials locally. Wang explained that attackers with physical access and specialized equipment could potentially execute unauthorized code before the operating system starts.
However, he emphasized that exploiting these vulnerabilities does not automatically reveal cryptocurrency seed phrases, because device encryption, passcodes and Apple’s Secure Enclave provide additional protection. The disclosure concerns existing hardware weaknesses rather than evidence of a newly discovered cryptocurrency theft campaign targeting affected iPhones.
Two BootROM Exploits Affect Multiple iPhone Generations
The first vulnerability, known as checkm8, was publicly disclosed in 2019 and affects devices ranging from the iPhone 4S through the iPhone X. A second exploit, usbliter8, disclosed in June 2026, targets Apple’s A12 and A13 processors, including the iPhone XS, XR, iPhone 11 series and second-generation iPhone SE. Both vulnerabilities affect the BootROM, the initial code executed when an iPhone powers on. Because BootROM instructions are permanently embedded in the device’s processor, Apple cannot directly replace the vulnerable code through an ordinary software update.
An attacker may exploit the weakness by placing an affected device into Device Firmware Update mode and connecting specialized USB hardware. This can allow unauthorized code execution before iOS loads, potentially bypassing certain operating-system security restrictions. Airplane mode does not prevent this attack method because it relies on direct physical access rather than wireless connectivity. Nevertheless, the BootROM exploits alone do not establish access to protected wallet credentials.
On newer affected devices, the Secure Enclave continues to provide hardware-backed protections for encryption keys and passcode verification. Additional vulnerabilities, weak passcodes or inadequately protected wallet files may be necessary for an attacker to extract usable recovery information. The practical risk therefore depends on the device’s security configuration, wallet implementation and whether an attacker can obtain physical access.
Crypto Holders Urged to Replace Potentially Exposed Recovery Phrases
Wang recommended that users who have stored seed phrases on affected devices consider migrating their assets to wallets generated in a trusted environment. A cryptocurrency seed phrase typically consists of 12 or 24 words that can restore control over the private keys associated with a wallet. Anyone obtaining that phrase may be able to transfer the wallet’s assets without possessing the original device. Wang stressed that generating another address from an existing seed phrase would not eliminate the risk if the original phrase had been compromised. Instead, users should generate an entirely new recovery phrase and transfer their holdings to addresses controlled by it.
He also recommended stronger alphanumeric passcodes, updated operating systems and avoiding unfamiliar USB accessories or public charging connections. Users whose devices have been outside their control for extended periods face additional physical-tampering risks. Wang noted that no equivalent publicly disclosed BootROM exploit currently affects the iPhone 12 and newer generations discussed in his warning. However, newer devices are not immune to software vulnerabilities or other attack methods. The advisory highlights the distinction between disconnecting a device from the internet and protecting its underlying hardware. For cryptocurrency investors using self-custody, the central concern is safeguarding recovery credentials against both remote compromise and attackers with temporary physical access.
