Older iPhones that store cryptocurrency recovery phrases are at a continuous security risk due to unpatchable BootROM vulnerabilities, even if the devices are wiped and kept in airplane mode.
While attackers require physical access to exploit this vulnerability, doing so does not automatically reveal encrypted wallet data. However, other weaknesses could potentially allow them to steal the recovery seed.
In a public warning, OneKey founder Yishi Wang cautioned against treating retired iPhones as secure cold wallets. His concern centers on hardware weaknesses that survive factory resets and cannot be removed through ordinary iOS updates.
Hardware Flaws in Older iPhones
The checkm8 BootROM exploit, disclosed in 2019, affects devices from the iPhone 4S through iPhone X. The newer usbliter8 exploit extends boot-chain compromise to A12 and A13 devices, including the iPhone XS, XR, iPhone 11 family, and second-generation iPhone SE.
BootROM, also called SecureROM, contains the first instructions executed during startup. Because this code is permanently embedded in the processor, affected devices cannot receive a conventional software repair for these flaws.
For usbliter8, an attacker places the device into Device Firmware Update mode and connects specialized USB hardware, such as an RP2350-based microcontroller. The exploit combines a USB-controller hardware flaw with an insecure SecureROM configuration to execute unauthorized code before iOS loads. Airplane mode offers no protection against this physical pathway.
Technically, malformed USB setup packets trigger a DMA pointer underflow, allowing writes into memory used by SecureROM. On affected chips, the Data Address Resolution Table configuration fails to contain those writes. A13 exploitation additionally requires bypassing Pointer Authentication protections.
The crucial distinction is encryption: boot-level execution does not itself compromise the Secure Enclave or instantly decrypt a recovery phrase. Device passcodes and wallet encryption remain meaningful barriers, particularly on newer affected models.
The danger increases when owners combine outdated iOS releases, weak passcodes, and short wallet passwords. If attackers obtain a wallet file protected only by a weak password, offline guessing may expose its contents without the phone enforcing attempt limits.
Techniques used in iOS forensic extraction illustrate why boot-chain access matters, although successful extraction depends on device configuration and additional vulnerabilities.
A separate threat, ChoiceJacking through malicious charging ports, demonstrates how hostile USB accessories can impersonate input devices and manipulate data-access approval on vulnerable phones. It is distinct from BootROM exploitation.
Wang recommends migrating exposed wallets to entirely new recovery phrases generated in a trusted environment, then transferring assets. Creating another address under the same seed does not invalidate a stolen phrase.
Owners should prioritize physical custody, stronger alphanumeric passcodes, current software, and trusted charging equipment. Newer hardware reduces exposure to these specific exploits, but software updates cannot repair immutable BootROM code in affected phones.
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.
