OneKey

Old iPhones Remain Vulnerable to Bootloader Exploits Despite Airplane Mode, OneKey Warns Crypto Users

Founder of hardware wallet maker OneKey Ishan Wang has cautioned that storing cryptocurrency seed phrases on reset older iPhones in airplane mode does not provide reliable protection. Physical access attacks leveraging persistent bootloader vulnerabilities such as checkm8 and usbliter8 can bypass standard iOS security even on devices without network connectivity. The checkm8 exploit affects iPhone models from 4S through X, while usbliter8 targets A12 and A13 chips found in iPhone XS, XR, 11 series and second-generation SE devices. These flaws allow attackers to break the secure boot chain and execute arbitrary code before the operating system loads, and factory resets do not mitigate them because the vulnerable bootloader code cannot be overwritten through normal updates. Although bootloader access alone does not decrypt wallet contents due to device passcode, Secure Enclave protections and application-level encryption, the overall risk depends on device model, iOS version, additional vulnerabilities and password strength. Wang advises against relying on legacy offline iPhones as cold storage and recommends generating a fresh seed phrase and transferring assets if exposure is suspected.