OneKey Founder Warns Pre-2020 iPhones Put Seed Phrases at Unpatchable Risk

BootROM Flaws Software Cannot Fix

OneKey founder Yishi Wang warned cryptocurrency holders on October 31 against keeping a seed phrase on older iPhones, citing startup-level flaws that no software update can remove. In a post on X, Wang explained that some devices released before 2020 carry vulnerabilities in their boot systems which Apple cannot repair through software. He set the warning against a backdrop of repeated public jailbreaks over the preceding two weeks, events he said most observers had scrolled past as tech drama without registering what they meant for crypto storage. A common practice among holders is to repurpose an old handset as a cold wallet: strip the apps, cut the network connections and keep recovery material offline. Wang questioned that habit for phones carrying known BootROM weaknesses. The BootROM holds the first instructions a device executes when it powers on, and because those instructions are burned permanently into the processor, an iOS update cannot overwrite the affected code. Two documented exploits cover the exposed generations. The first, checkm8, went public in 2019 and reaches every model from the iPhone 4S to the iPhone X. The second, usbliter8, was disclosed in June 2026 and targets Apple's A12 and A13 processors, found in the iPhone XS, XR, the iPhone 11 series and the second-generation iPhone SE. Researchers showed that an attacker with physical access can hijack the startup process over USB: the phone is placed into Device Firmware Update mode, specialized equipment is attached, and unauthorized code runs before iOS loads. Airplane mode blocks nothing here, since the exploit never touches the network. For OneKey, which builds hardware wallets, the statement amounts to a caution against a shortcut many holders treat as free security. Wang added that iPhone 12 and newer models are not known to be affected by either flaw, and he steered holders toward newer, regularly updated devices for storage.

Where the Risk Actually Sits

Wang drew a careful line between a flawed BootROM and an emptied wallet. Exploiting the startup code does not by itself open a crypto wallet: on models such as the iPhone XS and iPhone 11, the passcode, file encryption and Apple's Secure Enclave still separate an attacker from stored keys. The danger concentrates where users lean on weak defenses. A six-digit numeric passcode leaves one million possible combinations, and forensic tools can in some cases bypass the restrictions that normally throttle password guessing. Wallet applications add another surface: an encrypted wallet file protected only by a weak app password, once extracted, can be attacked offline. Wang also described the “evil maid” scenario, in which a phone left in a hotel room, handed to an inspector or borrowed for charging is tampered with quietly, with nothing unusual visible on its return. His remarks landed amid a run of jailbreak work on newer devices. At the Hexacon security conference in Paris on October 16, the Calif research team reportedly demonstrated an iPhone 18 Pro jailbreak on iOS 27.0.1, bypassing Apple's Memory Integrity Enforcement protections. Apple shipped iOS 27.2 on October 26 to address vulnerabilities reportedly used in those demonstrations, and Wang noted an October 30 claim from Ikotas Labs concerning iOS 27.2 that he judged unconfirmed on the available video. He separately flagged ChoiceJacking, a technique disclosed in 2025 that lets malicious USB accessories imitate user input, which Apple closed in iOS 18.4. The caution also follows Singapore police reports of roughly S$3.5 million in cryptocurrency losses tied to modified Ledger devices, where hidden components captured recovery phrases during setup, a pattern echoing the Qubic incident in which weak seeds drained $1.4 million from 1,400 wallets. For anyone who stored a phrase on an affected phone, Wang's advice is to create entirely new wallets in a trusted environment and move the holdings, since generating another address from the same exposed phrase resolves nothing.

Replacement, Not Rotation

The load-bearing distinction in Wang's October 31 post sits between flaws Apple can patch and flaws burned into silicon: the recent iOS 27 demonstrations belong to the first group, the checkm8 and usbliter8 class to the second. That is also why his remedy is replacement rather than rotation, because a new address derived from an exposed phrase inherits the exposure; guides on securing seed phrases walk through that replacement sequence in detail. What the post does not establish is exploitation in the wild. No confirmed case of a BootROM attack used against a holder appears in the record, and the Singapore case involved modified hardware rather than a hijacked boot process. Until such evidence surfaces, the warning stands as a precaution, weighted by how inexpensive physical tampering has already proved to be.