OneKey founder Yishi Wang has urged cryptocurrency holders to move seed phrases off older iPhones, warning that hardware vulnerabilities could undermine offline storage security. In a Saturday post on X, he highlighted risks affecting iPhone 11 models and earlier devices, even when owners disable internet connections.
Wang said physical access can allow attackers to exploit weaknesses before iOS starts. Consequently, wiping a device and enabling airplane mode cannot eliminate every threat to crypto wallets.
The iPhone 4S through iPhone X contain the checkm8 BootROM vulnerability, while the usbliter8 exploit targets the XS, XR, iPhone 11 series, and second-generation SE. Moreover, attackers need physical access and specialized hardware to exploit these flaws.
However, the vulnerabilities do not automatically expose seed phrases. Short passcodes, outdated software, and weak wallet passwords can reduce existing protections.
Additionally, researchers have warned about mobile threats such as Coruna, which targets cryptocurrency users through a different attack method. Apple fixed the specific ChoiceJacking issue in iOS 18.4.
Wang recommends generating a new seed phrase in a trusted environment and transferring assets to wallets linked to it. Hence, creating new addresses under an existing seed will not resolve the underlying risk.
He also advises users to update devices, choose strong alphanumeric passcodes, avoid unknown chargers, and consider Lockdown Mode. Meanwhile, he said no public BootROM exploit was known for iPhone 12 or newer models.
