OneKey Founder Warns iPhone 11 and Older Models Have Unpatchable Flaws That Put Crypto Seed Phrases at Risk

If your crypto recovery phrase sits on an old iPhone in a drawer, OneKey founder Yishi Wang says it should not be there.

In posts reported around Oct. 31 and Nov. 1, 2026, Wang warned that iPhone 11 series devices and earlier models contain hardware flaws that no iOS update can repair. His concern is people who treat a wiped, offline phone as a cheap cold wallet.

OneKey is a crypto hardware wallet company. Wang is warning about a product category his company competes with. That doesn't make the technical claims wrong, and the exploits he names are publicly documented. It is context for his recommendations.

Two exploits, one unfixable layer

Both flaws target the BootROM, the first code an iPhone runs when it powers on. It is permanently etched into the processor, so Apple cannot rewrite it with a software update.

The first, checkm8, became public in 2019. It affects iPhones from the 4S through the iPhone X.

The second, usbliter8, was disclosed in June 2026. It targets Apple's A12 and A13 processors, which covers the iPhone XS, XR, the iPhone 11 series and the second-generation iPhone SE.

Between them, the two exploits span a wide stretch of Apple's lineup. Any iPhone 11 or older falls on one list or the other: checkm8 covers the 4S through the X, and usbliter8 covers the XS, XR, 11 series and second-generation SE.

How an attack would work

The attacker needs physical access to the phone. According to Wang, it doesn't have to be long.

The attacker puts the phone into Device Firmware Update (DFU) mode, a low-level recovery state, and connects specialized USB equipment. Code then runs before iOS loads, so the operating system's defenses never engage.

Airplane mode doesn't stop it. The exploit does not require internet access, and one account says a factory reset doesn't stop it either.

Wang says the attack leaves no visible trace. That is the classic "evil maid" scenario: a phone left in a hotel room, handed over for inspection or borrowed for charging could be tampered with, and the owner might notice nothing when it is returned.

What still protects the wallet

Wang is explicit that compromising the BootROM does not automatically open a wallet. On devices like the iPhone XS and iPhone 11, the passcode, device encryption and Apple's Secure Enclave remain barriers.

The risk climbs when those barriers are weak. A six-digit numeric passcode has only one million combinations. Depending on the device and the exploits available, forensic tools may try to get around the limits that normally throttle password guessing.

Wallet apps are a second weak point. If an attacker extracts an encrypted wallet file protected only by a weak application password, the file may be vulnerable to offline password-guessing attempts.

That is the opposing view inside Wang's own warning: the flaw is permanent, but the damage depends on how the phone is secured and who can get their hands on it. A phone locked away somewhere safe is a much smaller target than one that is lost, stolen or left unattended in shared spaces.

What Wang recommends

For anyone who has stored a seed phrase on one of these devices, Wang's central advice is to generate a completely new seed phrase in a trusted environment and move the assets to it.

He says creating new addresses under the old phrase is not enough. The seed phrase is the master key behind every address in a wallet. If it was exposed, fresh addresses derived from it are exposed too.

His secondary steps for people who keep using an affected device:

• Switch from a six-digit PIN to a long alphanumeric passcode.
• Turn on Lockdown Mode.
• Keep iOS updated.
• Use your own charger and avoid public USB ports.
• Treat any stretch when the phone is out of your control as a physical-attack risk.

The USB advice follows from how the exploits work. The attack depends on a USB connection, so limiting where your phone gets plugged in limits the exposure.

The self-custody problem

Crypto self-custody means no bank and no fraud department. If a recovery phrase is stolen and the funds are drained, there is nobody to call.

That is why the repurposed-phone approach draws scrutiny. It looks tidy: wipe the device, cut the network, and nobody can hack it remotely. Wang's point is that this reasoning covers remote attacks and does nothing about someone holding the phone.

The warning describes what an attacker with the right tool and brief access could do. It does not describe a specific theft.

Holders with seed phrases on an iPhone 11 or older face a practical choice. They can migrate to a new phrase on trusted hardware, as Wang urges, or keep the old phone and lock it down with a long passcode, Lockdown Mode and tight physical custody.

Wang says iPhone 12 and newer models are not known to be affected by the two BootROM exploits, and he recommends newer, regularly updated devices for cryptocurrency storage. His position is that only a full migration to a fresh seed phrase fixes a phrase that may already have been exposed.