Older iPhones used for storing cryptocurrency seed phrases can still face physical attacks, and airplane mode does not stop that risk. OneKey founder Yishi warned that wiping an aging iPhone and keeping it offline does not turn it into a secure cold wallet.
What bootrom access changes
The concern centers on BootROM flaws that let an attacker run code before iOS begins. That access does not automatically reveal protected wallet secrets, because a seed phrase is the recovery secret that controls access to a cryptocurrency wallet. The warning applies to people who keep that secret on older Apple hardware and assume that cutting network access removes the main danger.
Affected devices and exploit path
The checkm8 exploit reaches older iPhones through the iPhone X. A newer exploit, usbliter8, extends BootROM attacks to Apple’s A12 and A13 chips, including the iPhone XS, XR, iPhone 11 family, and second-generation iPhone SE. Researchers disclosed usbliter8 in June 2026.
An attacker must put a compatible iPhone into Device Firmware Update mode and connect special USB hardware. Crafted USB traffic causes memory corruption, which lets attacker-controlled code run before the operating system loads. Public demonstrations used a Raspberry Pi Pico 2 board, showing that the needed hardware does not have to be expensive.
How the flaw works
BootROM is the first code a device runs when it powers on. It is built into the chip during manufacturing, so Apple cannot replace the vulnerable code through a normal iOS update. The technical weakness combines faulty USB controller behavior with missing memory restrictions during early startup, which allows USB writes to reach memory outside their intended area.
Researchers then redirect execution and load unsigned boot software, bypassing checks that normally restrict devices to Apple-approved code. The important limit is that usbliter8 does not directly compromise Apple’s Secure Enclave, the separate security component that protects sensitive keys and passcode operations.
What remains protected
Researchers say encrypted user data remains behind additional barriers even after the main processor’s boot chain is compromised. Wallet theft would therefore need further weaknesses, access to decrypted information, or another attack against the remaining protections. Yishi also warned that weak passwords and outdated software can increase exposure, while stressing that the warning describes a possible attack path and not proof that every affected iPhone wallet can be emptied through BootROM access alone.
Related physical attack risks
Physical USB risks extend beyond BootROM exploits. Earlier ChoiceJacking research showed how malicious charging equipment could manipulate input and approve data connections on vulnerable devices. That is a separate attack, but it reinforces why an offline phone still needs careful handling.
Protection steps and recovery advice
Owners should check their device model, install available security updates, and avoid treating airplane mode as a complete defense. Updates cannot rewrite vulnerable BootROM, but they still address weaknesses elsewhere in the software. Strong device passcodes and wallet passwords remain important additional barriers.
Anyone concerned that a stored seed was exposed should generate a new seed in a trusted environment and transfer funds. Creating another address from the original seed does not remove the underlying risk.
Licensed under CC BY-ND 4.0 International