Odaily Planet Daily report: Yishi, founder of OneKey, posted on X platform warning that using older iPhone models as cryptocurrency cold wallets may pose security risks. The checkm8 vulnerability present in the BootROM of iPhone 4S through iPhone X, and the usbliter8 vulnerability disclosed in June—which also affects iPhone XS, XR, iPhone 11 series, and second-generation SE—both involve the device’s underlying boot code and cannot be patched via iOS system updates. After gaining physical access to the device, attackers can execute code via the USB interface before iOS boots, and enabling airplane mode does not prevent such attacks.
Yishi recommends that iPhone 11 and earlier models should not be used to store mnemonic phrases. Users who have already stored their mnemonics on such devices should generate a completely new mnemonic phrase in a trusted environment and migrate their assets, rather than simply changing the wallet address under the original mnemonic. Additionally, users should promptly update their system software, use more complex device and wallet passwords, avoid charging via public USB ports, and remain vigilant against potential physical attacks during periods when their device is out of their control.
Previously, OneKey founder Yishi posted on X recommending users use an iPhone as a cold wallet, but only suggested iPhone 17 or newer models.