Using an OLD iPhone as a cold wallet may not be as safe as you think, OneKey founder Yishi Wang warns.
Following several public iPhone jailbreak demos over the past two weeks, he highlighted a risk for crypto holders.
Wiping the device and enabling airplane mode does not remove chip vulnerabilities affecting iPhone 11 and earlier models, including the second-gen SE.
The BootROM flaws cannot be fixed through iOS updates.
THE RISKS:
- A phone accessed while unattended or borrowed may look normal when returned. This is known as an “evil maid” attack.
- An attacker could use specialized USB tools to run code before iOS starts. No internet connection is needed.
- Outdated software, short PINs and weak wallet passwords could make an attack easier. If an encrypted wallet file is extracted, attackers could keep guessing its password offline.
- Yishi cites ChoiceJacking, a separate technique that can approve data-access prompts on vulnerable older software. Apple addressed it in iOS 18.4.
Yishi recommends generating a completely new seed in a trusted environment and transferring funds. A new address under the old seed is not enough.
Of note, users with recent, updated iPhones have LESS reason for concern.
Following several public iPhone jailbreak demos over the past two weeks, he highlighted a risk for crypto holders.
Wiping the device and enabling airplane mode does not remove chip vulnerabilities affecting iPhone 11 and earlier models, including the second-gen SE.
The BootROM flaws cannot be fixed through iOS updates.
THE RISKS:
- A phone accessed while unattended or borrowed may look normal when returned. This is known as an “evil maid” attack.
- An attacker could use specialized USB tools to run code before iOS starts. No internet connection is needed.
- Outdated software, short PINs and weak wallet passwords could make an attack easier. If an encrypted wallet file is extracted, attackers could keep guessing its password offline.
- Yishi cites ChoiceJacking, a separate technique that can approve data-access prompts on vulnerable older software. Apple addressed it in iOS 18.4.
Yishi recommends generating a completely new seed in a trusted environment and transferring funds. A new address under the old seed is not enough.
Of note, users with recent, updated iPhones have LESS reason for concern.