OneKey founder Yishi has warned that iPhone 11 series devices and earlier models contain hardware vulnerabilities that cannot be patched through software updates. These flaws could potentially expose wallet seed phrases to attackers who gain brief physical access to the device.
The vulnerabilities center on two known exploits targeting the BootROM, the foundational code layer that runs when an iPhone powers on and is etched directly into the chip. Because it exists in hardware rather than software, Apple cannot issue patches to fix it.
The Two Exploits
The first exploit, checkm8, has affected iPhone models from the 4S through the X since its public disclosure in 2019. The second, usbliter8, is newer and was disclosed in June 2026. It impacts the iPhone XS, XR, the 11 series, and the second-generation iPhone SE.
Together, these flaws cover a broad range of iPhone models, affecting any device from the 11 series or earlier.
How the Attack Works
An attacker would need physical access to the device, though the access need not be prolonged. The method involves placing the iPhone into DFU (Device Firmware Update) mode and connecting a specialized USB tool. From this state, an attacker could execute code before iOS starts up, bypassing the operating system's security defenses.
According to Yishi, the attack leaves no trace, meaning a victim could retrieve their phone unaware that any compromise occurred.
Existing Protections
Device passcodes and the Secure Enclave—a dedicated security chip handling sensitive data separately from the main processor—remain barriers to exploitation. However, their effectiveness depends on implementation, with weak passwords and outdated wallet apps increasing risk.
Recommended Actions
Yishi advised affected users to abandon current seed phrases entirely and create new ones on secure devices, transferring assets to fresh addresses. He emphasized that generating new addresses from a compromised seed phrase is insufficient, as all addresses still trace back to the same exposed master key.
Additional recommended steps for users still operating affected devices include:
- Using strong alphanumeric passcodes instead of short numeric ones
- Enabling Lockdown Mode, Apple's hardened security setting
- Avoiding connections to public USB ports
The USB precaution directly addresses the attack vector, as limiting where the phone connects can reduce exposure risk.
Broader Implications
The checkm8 exploit has been known since 2019, leaving owners of iPhone X and older devices with a permanent hardware security gap. The June 2026 disclosure of usbliter8 extended this vulnerability to newer, more widely used models including the iPhone 11 series and SE2.
Some cryptocurrency holders use older iPhones as a form of cold storage for managing funds. These BootROM flaws challenge the assumption that such hardware remains inherently trustworthy at the foundational level.
