Yishi Wang, founder of hardware wallet manufacturer OneKey, has warned that using older iPhone models as cold storage for seed phrases poses significant security risks. The vulnerability stems from hardware-level flaws in the BootROM, which cannot be patched through iOS software updates.
The checkm8 exploit, disclosed in 2019, affects iPhone models from 4S through X. A more recent exploit, usbliter8, identified in June 2026, impacts devices equipped with A12 and A13 chips, including the iPhone XS, XR, the 11 series, and the second-generation SE.
These exploits require physical access to the device and a USB connection to specialized hardware, such as a Raspberry Pi Pico. Because the vulnerability resides in the chip's boot code, airplane mode does not protect the device from potential attacks.
While the BootROM bug alone does not expose seed phrases, it can be combined with weak passcodes or outdated software to facilitate unauthorized access. Wang advises users to migrate assets to a new seed phrase on a newer iPhone model that lacks these hardware-level vulnerabilities.
