OneKey Founder: Older iPhones carry hardware-level security risks when storing mnemonic phrases, with even Airplane Mode failing to offer protection.

OneKey founder Yishi has issued a warning: resetting an older iPhone to factory settings, enabling Airplane Mode, and using it solely to store wallet mnemonics does not guarantee security. iPhone 11 and earlier models have BootROM hardware vulnerabilities that cannot be patched via iOS updates. Attackers with physical access to the device can run code before iOS boots via the USB port and custom hardware—a threat Airplane Mode cannot block. Yishi pointed out that iPhone 4S through iPhone X are affected by the 2019-disclosed checkm8 vulnerability, while iPhone XS, XR, 11 series, and second-generation iPhone SE are impacted by the usbliter8 research published this June. However, BootROM vulnerabilities alone do not let attackers directly retrieve mnemonics; protections like device passcodes and the Secure Enclave remain intact. But outdated systems, simple passcodes, and weak encryption in wallet apps may further escalate risks. Older iOS versions are also vulnerable to attacks from malicious charging devices. Yishi’s advice for users storing mnemonics on iPhones: migrate to an iPhone 12 or newer model, generate new mnemonics and transfer assets in a trusted environment; use longer alphanumeric passcodes, avoid public USB charging ports; and if the device has been out of your control for a long time, migrate assets immediately. He also noted that no similar public BootROM vulnerabilities have been disclosed for iPhone 12 and newer models, while risks on older devices are chip-level and cannot be resolved solely through system updates.