OneKey Founder: iPhone 11 and Earlier Models Have Chip-Level Vulnerabilities; Airplane Mode Cannot Guarantee Seed Phrase Security

TechFlow reported on November 1 that OneKey founder Yishi warned that factory resetting an older iPhone, enabling airplane mode, and using it as a cold wallet to store a seed phrase does not mean asset security is fully guaranteed. iPhone 11 and earlier models have BootROM chip-level vulnerabilities that cannot be fixed through iOS updates; even if the device is completely offline, attackers may still carry out attacks through physical access.

Yishi noted that the checkm8 vulnerability affects iPhone 4S through iPhone X, while the usbliter8 vulnerability disclosed in June this year further affects the iPhone XS, XR, 11 series, and second-generation iPhone SE. After obtaining a device, attackers can use DFU mode and custom USB hardware to execute code before iOS boots; airplane mode cannot prevent such attacks. However, a BootROM vulnerability itself does not mean that a seed phrase will be directly exposed; device passcodes, the Secure Enclave, and wallet app encryption still provide additional protection.

Yishi advised users who store seed phrases on older iPhones to consider replacing their devices, generating a new seed phrase in a trusted environment, and transferring assets to a new wallet, rather than merely creating a new address under the original seed phrase. Users should also use strong passwords, update their systems promptly, and avoid leaving devices outside personal control for extended periods.

Source: TechFlow