OneKey founder Yishi warned users who store their crypto wallets’ recovery words on some older iPhones, saying that resetting the phone and putting it in airplane mode do not eliminate hardware-related risks.
The warning, reported by Wu Blockchain, concerns people who use an old phone as a wallet backup without connecting it to the internet. According to Yishi, keeping the device offline may not provide sufficient protection if an attacker gains physical access to the phone. The issue here is storing the recovery words used to reopen the wallet on the device.
Which iPhone models are covered by the warning?
Yishi listed models from the iPhone 4S through the iPhone X as affected by the checkm8 vulnerability. For the iPhone XS, XR, 11 series, and second-generation iPhone SE, he pointed to the usbliter8 vulnerability.
According to the warning, because these vulnerabilities are in the BootROM layer that runs when the device starts up, they cannot be fixed with iOS updates. For the same reason, restoring the device to factory settings does not eliminate the vulnerability.
However, exploiting the vulnerabilities requires physical access to the device and specialized tools. Being in airplane mode does not prevent an exploit that can be carried out over USB.
The presence of a vulnerability does not mean direct access to recovery words
Yishi also emphasized that, particularly on models such as the XS and 11, these vulnerabilities alone are not enough to obtain recovery words. The device passcode and a security component called Secure Enclave provide additional layers of data protection.
His recommendation for people storing recovery words on affected devices was to create an entirely new wallet in a trusted environment and move their assets to it. Yishi also advised using newer devices, keeping software up to date, and choosing strong passcodes.
Not investment advice.