Older iPhones used to store cryptocurrency seed phrases could expose owners to physical attacks that airplane mode cannot stop. OneKey founder Yishi has warned that wiping an aging iPhone and keeping it offline does not make it a secure cold wallet.
The concern involves BootROM flaws that let attackers run code before iOS starts. However, this access does not automatically reveal protected wallet secrets. A seed phrase is the recovery secret that controls access to a cryptocurrency wallet.
Yishi’s warning focuses on people keeping that secret on older Apple hardware, often believing that removing network access removes the main security risks. These attacks instead depend on someone gaining physical access to the device.
The checkm8 exploit affects older iPhones through the iPhone X. A newer exploit, usbliter8, extends BootROM attacks to Apple’s A12 and A13 chips, including the iPhone XS, XR, iPhone 11 family, and second-generation iPhone SE. Researchers disclosed usbliter8 in June 2026.
BootROM is the first code a device runs when switched on. It is built into the chip during manufacturing, so Apple cannot replace the vulnerable code through a normal iOS update.
Cybersecurity News previously covered the usbliter8 BootROM vulnerability, explaining how it breaks the application processor’s trusted boot process.
An attacker places a compatible iPhone into Device Firmware Update mode and connects special USB hardware. Carefully crafted USB traffic causes memory corruption, allowing attacker-controlled code to run before the operating system loads. Public demonstrations have used a Raspberry Pi Pico 2 board, showing that the required hardware need not be expensive.
iPhone BootROM Flaws
The technical weakness combines faulty USB controller behavior with missing memory restrictions during early startup. On affected chips, USB writes can reach memory outside their intended area.
Researchers then redirect execution and load unsigned boot software, bypassing checks that normally restrict devices to Apple-approved code.
The important limit is that usbliter8 does not directly compromise Apple’s Secure Enclave, the separate security component protecting sensitive keys and passcode operations. Researchers say encrypted user data remains behind additional barriers even after the main processor’s boot chain is compromised.
Wallet theft would therefore require further weaknesses, access to decrypted information, or another attack against remaining protections.
Yishi warned that weak passwords and outdated software can increase exposure. His warning describes a possible attack path, not evidence that every affected iPhone wallet can be emptied through BootROM access alone.
Physical USB risks also extend beyond BootROM exploits. Earlier ChoiceJacking research showed how malicious charging equipment could manipulate input and approve data connections on vulnerable devices. That is a separate attack, but it reinforces why an offline phone still needs careful handling.
Owners should check their device model, install available security updates, and avoid treating airplane mode as a complete defense. Updates cannot rewrite vulnerable BootROM, but they still address weaknesses elsewhere in the software. Strong device passcodes and wallet passwords remain important additional barriers.
Anyone concerned that a stored seed was exposed should generate a new seed in a trusted environment and transfer funds. Creating another address from the original seed does not remove the underlying risk.
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.
