1. The warning from OneKey's founder
On November 1, 2026, Yishi, the founder of hardware wallet maker OneKey, cautioned crypto holders that the iPhone 11 series and every earlier model contain hardware vulnerabilities that no software update can repair. In his assessment, an attacker who gets even short physical access to such a phone could potentially reach the seed phrase of a wallet stored on it. His advice is blunt: anyone keeping a seed phrase on one of these devices should move to a new one soon.
The caution matters because a seed phrase is the master credential for a self-custodied wallet. Whoever holds it controls every address derived from it, along with the assets sitting there. A weakness at the level of the phone's silicon therefore raises a question about the whole arrangement, not about a single app.
Warnings of this kind tend to attract attention in crypto circles for a simple reason. Phones are the most common way people interact with wallets, and many holders have kept using the same handset for years. A flaw that cannot be fixed by an update turns an old device from a convenience into a liability, and the decision about what to do with it rests entirely with the owner.
2. What is the BootROM, and why can't it be patched?
The BootROM is the first piece of code an iPhone runs when it powers on. It is etched into the processor during manufacturing and cannot be rewritten afterward. Yishi compared it to the foundation of a house: everything else is built on top of it, and if the foundation has a crack, repairing the upper floors does nothing for it.
That permanence is both a design strength and the source of the problem. Because the code cannot be altered, nobody can tamper with it through a malicious update, which makes it a dependable anchor for the rest of the startup sequence. The cost is that when a flaw is found, Apple has no mechanism to push a correction. The only real remedy is replacing the hardware with a newer chip that does not share the defect.
3. Two exploits, one long span of devices
Two known exploits target this layer. The first, called checkm8, has been public since 2019 and affects iPhones from the 4S through the iPhone X. The second, usbliter8, was disclosed in June 2026 and covers the iPhone XS, the XR, the 11 series and the second-generation iPhone SE.
Taken together, the two flaws reach across much of the iPhone's history. In Yishi's framing, any device from the 11 series or earlier falls inside the affected range. For owners of the X and older models, the gap has existed for years. The June disclosure widened it to phones that many people still regard as reasonably current.
4. How an attack on a vulnerable iPhone would work
An attacker needs hands-on access to the phone, but not for long. The procedure described involves putting the iPhone into DFU mode, short for Device Firmware Update, a low-level recovery state, and then attaching a specialized USB tool. From that position the attacker can run their own code before iOS has started at all.
That ordering is what makes the approach significant. Most of the protections people associate with an iPhone live inside the operating system. Code that executes before the operating system loads can sidestep them, because those defenses have not yet been put in place.
Yishi also pointed to the lack of visible evidence. According to him, such an attack leaves no trace, so an owner who recovers a phone that was briefly out of sight might never suspect anything happened. A lost, borrowed or confiscated device is therefore the kind of situation worth worrying about.
5. Which protections still stand?
The picture is not entirely bleak. The device passcode and the Secure Enclave, a dedicated security chip that handles sensitive keys, remain obstacles between an attacker and the data on the phone. Neither disappears simply because the BootROM has been compromised.
The strength of those barriers depends on how they are used, however. A short or predictable passcode is far easier to guess than a long one, and an outdated wallet application can add weaknesses of its own. The underlying research behind the warning makes this point as well: the exposure grows when weak passwords or neglected software are involved, and shrinks when both are handled carefully.
This is why the claim should be read as a statement about risk rather than a guarantee of theft. The flaws open a door at the lowest level of the device, and what lies behind that door still depends on the choices of the person who owns it.
6. Why a new seed phrase, not just a new address?
Yishi's central recommendation is to start over instead of patching around the problem. Affected users, he said, should generate a fresh seed phrase in a secure environment and move their assets to it. Creating additional addresses under the existing phrase does not solve anything in his view.
The reasoning follows from how wallets are built. A single seed phrase produces every address in the wallet, so a new address created from the same phrase still traces back to the same exposed secret. If that secret has been copied, any address derived from it is equally open. Only a phrase generated from scratch, on trustworthy hardware, breaks the connection to the old one.
7. Practical steps for owners who cannot upgrade right away
For people who cannot replace a phone immediately, Yishi listed several measures that lower the exposure without eliminating it. The first is a strong alphanumeric passcode in place of a short numeric code. The second is Lockdown Mode, Apple's optional setting that restricts features to reduce the attack surface. The third is avoiding public USB ports.
The last item follows directly from how the attack works. Since the technique depends on a USB connection, limiting where and how a phone is plugged in limits the opportunities an attacker has. Public charging stations and unfamiliar cables are the obvious places to be careful.
These steps reduce the chance of a successful attack, but they are described as mitigations, not cures. The advice to migrate to a new seed phrase stands regardless of how well a phone is configured.
8. How does this compare with a dedicated hardware wallet?
A dedicated hardware wallet exists to keep private keys on a device built only for that job, away from the general-purpose software that runs on a phone. The idea is that signing happens inside a separate component, so the keys are never exposed to the apps, browsers and messages that make up everyday phone use. The OneKey warning shows the other side of that logic: a phone pressed into the same role inherits a much wider surface, and, in the case of these models, a flaw in the chip that cannot be closed.
The distinction also explains why the recommendation is to generate the replacement phrase in a secure environment. A new seed phrase created on a device with the same weakness would offer no improvement. What counts is the trustworthiness of the place where the phrase is born and where it is later stored.
Self-custody places responsibility for every one of these decisions on the holder. Nobody can reverse a transaction signed with a stolen key, and no support desk can restore funds once they have left the wallet. For that reason, security specialists generally encourage holders to review the hardware behind their setup from time to time, not only the passwords and apps layered above it.
9. Why old phones show up in crypto setups
Older hardware often ends up in crypto routines for sensible-sounding reasons. Many holders keep funds accessible through a spare handset, and some turn a retired iPhone into a homemade cold storage device: wiped clean, kept offline and used only to open a wallet. The appeal is obvious, since the phone is already owned and costs nothing extra.
Strategies like these rest on an assumption that the device itself can be trusted. The BootROM flaws challenge that assumption at the most basic level, because they concern the first instructions the chip ever executes, before any careful configuration by the user has taken effect. A phone that has been wiped and isolated is still running on the same silicon.
That observation is the broader lesson of the warning. Security setups built on general-purpose consumer hardware inherit whatever weaknesses that hardware has, including ones that were published years after the phone was bought. A device that looked suitable when the wallet was created may no longer meet that standard.
10. What owners should check next
The first step is to identify the model. An iPhone 11 or anything older falls inside the range Yishi described, as does the second-generation iPhone SE. Anyone who has ever created a wallet on such a phone, or who stores a seed phrase there, should consider that secret exposed to anyone who has had physical access to the device.
The next step is to build a replacement wallet on hardware outside the affected range, record the new seed phrase securely, and transfer the holdings. Only after the funds have moved does it make sense to treat the old phrase as retired.
No date or deadline accompanies the warning, and no software fix is expected, since the flaw sits in the chip itself. For that reason the advice carries a note of urgency: the longer a seed phrase stays on a vulnerable device, the longer the opportunity for someone with brief physical access to exploit it.