Storing seed phrases on an iPhone 11 or older models carries risks even after resetting the device and enabling airplane mode. These devices are vulnerable to attacks exploiting hardware flaws that cannot be fixed with an iOS update, warned Ishii Wang, founder of hardware wallet manufacturer OneKey.
The entrepreneur recalled two vulnerabilities in Apple smartphones. Disclosed in 2019, checkm8 affects iPhone generations from the 4S to the X. Discovered in June 2026, usbliter8 affects A12 and A13 chips, used in the XS, XR, 11 series, and second-generation SE.
Both exploits allow attackers to target BootROM—the initial boot code written to the chip during manufacturing. It runs before the operating system and is not changed when its updates are installed.
Usbliter8 persists on affected devices throughout their entire lifespan. This attack method no longer works on newer generations of chips.
Exploiting similar flaws requires an attacker to have physical access to the smartphone and connect it via USB to specialized equipment. An internet connection is not required.
“Airplane mode doesn’t change anything here,” Wang emphasized.
However, usbliter8 does not reveal the seed phrase by itself. The vulnerability does not break into the isolated Secure Enclave subsystem, which provides additional protection for user data.
According to the OneKey founder, a short passcode, an outdated version of iOS, and a weak wallet app password increase the risk. Whether an attacker can access the funds depends on the combination of these factors and how the secret data is stored.
The entrepreneur recommended that owners of older devices create a new seed phrase in a trusted environment and transfer their assets to a new wallet. This is especially important for smartphones that have been left unattended for a long time.
“You need a completely new seed phrase. A new address derived from the old one won’t help,” he explained.
The warning was prompted by October demonstrations of iPhone hacks by the Calif team. At the Hexacon conference, researchers showed several attacks, including scenarios involving Signal and iMessage.
On October 26, Apple released iOS 27.2, fixing numerous vulnerabilities, including ones discovered by Calif specialists.
As a reminder, SlowMist specialists warned that critical PHP vulnerabilities could pose a threat to Web3 projects through websites, servers, and transaction-signing services $MITO $SOPH
