OneKey Founder Warns iPhone 11 and Older Models Carry a Chip Flaw No Update Can Fix

If you keep a crypto wallet on an older iPhone, a warning published on November 1, 2026 deserves your attention. Yishi, the founder of hardware wallet maker OneKey, said iPhone 11 models and earlier phones carry hardware vulnerabilities that no software update can fix. According to reports of his post, those flaws could expose a stored seed phrase to an attacker who gets brief physical access to the phone. The warning is aimed squarely at people who treat an old phone as a safe offline vault. Yishi argues that approach rests on a shaky assumption, because the flaw sits below the operating system itself.

A seed phrase is the master key for a crypto wallet. Lose control of it, and an attacker can recreate the wallet on another device and move the funds. That is why the warning matters even for people who never connect the old phone to the internet. Yishi said wiping the phone and switching on airplane mode are not enough on an affected device. His core advice is blunt: stop using the old seed phrase entirely, create a new one on a secure device, and move assets to wallets linked to that new phrase.

What Yishi actually warned about

The warning centers on two known exploits that target the BootROM, the first code that runs when an iPhone powers on. Because BootROM code is baked into the chip, Apple cannot rewrite it with a software patch. That single fact is what turns an old flaw into a permanent one for the affected models.

The first exploit, checkm8, has been public since 2019 and affects models from the iPhone 4S through the iPhone X. The second, usbliter8, was disclosed in June 2026 and affects the iPhone XS, iPhone XR, the iPhone 11 series, and the second generation iPhone SE. Put together, the two flaws cover a wide stretch of iPhone history. Anyone using an iPhone 11 or an older model falls somewhere on the affected list, according to the reports.

Yishi posted the warning on October 31, 2026, and crypto outlets reported it on November 1, 2026. He said no public BootROM exploit was known for iPhone 12 or newer models. That detail matters, because it draws a clear line between phones that carry this specific hardware risk and phones that do not, at least based on what is publicly known today.

How an attack would work, according to the reports

The attack described in the reports needs physical access, but that access does not have to last long. An attacker would put the phone into DFU mode, a low level recovery state used to restore or reinstall software, and connect a specialized USB tool. From there, code could run before iOS ever starts. That timing is the problem. Protections built into the operating system never get a chance to act, because the intruder is already running code before the system loads.

According to the details Yishi shared, the attack can also leave no trace. A person could get the phone back and have no reason to suspect anything happened. That claim should be read carefully. It describes the risk as Yishi presented it, not a tested result for every phone and every setup. The device passcode still acts as a barrier, and the Secure Enclave, a dedicated security chip that handles sensitive data separately from the main processor, still plays a role. The catch, according to the reporting, is that those protections are only as strong as how they are used. Weak passcodes or outdated wallet apps increase the risk.

Why the advice is to start over, not to patch around it

Yishi advised affected users to abandon their current seed phrases entirely. That point is easy to misunderstand, so it is worth spelling out. Creating fresh wallet addresses under the same old seed phrase is not enough, in his view. A seed phrase generates every address in a wallet, so new addresses from a compromised phrase still trace back to the same exposed key. Moving funds to a new address that shares the old phrase would leave the same root key in play.

The safer path he described starts on a secure device. Create a brand new seed phrase there, set up wallets linked to it, and transfer assets to those wallets. Only after the move is confirmed should the old phrase be treated as retired. Users should also think about where the new phrase is stored. Writing it on paper and keeping it offline, away from photos, cloud notes, and screenshots, remains standard practice for seed phrase storage. Storing the new phrase on the same affected phone would defeat the point of the move.

Yishi also listed secondary steps for anyone still using an affected device. Use a strong alphanumeric passcode rather than a short numeric code. Turn on Lockdown Mode, Apple's hardened security setting that reduces attack surface. Avoid plugging into public USB ports or unknown chargers, since the exploits described rely on a USB connection. Keep devices and wallet apps updated where updates are still available, even though an update cannot fix the BootROM flaw itself. These steps lower risk, but they do not remove the hardware issue.

What this means for everyday iPhone owners

Most owners do not store a seed phrase on a phone, and for them this is a narrower warning about old hardware. Physical access attacks are targeted, since an attacker needs the device, a specialized tool, and time in DFU mode. For crypto holders, though, the prize is direct access to funds, so moving to a new phrase is worth the effort.

Frequently Asked Questions

Which iPhones are affected by the BootROM warning?

According to reports of Yishi's warning, checkm8 affects iPhone 4S through iPhone X, and usbliter8 affects iPhone XS, iPhone XR, the iPhone 11 series, and the second generation iPhone SE. No public BootROM exploit was reported for iPhone 12 or newer models.

Can a software update fix a BootROM flaw?

No, according to the reports. BootROM code runs before iOS starts and is baked into the chip, so Apple cannot rewrite it with a software patch. Updates can still improve other protections, but they do not remove this hardware flaw.

Should I just create a new wallet address on the same phone?

Yishi advised against that shortcut. New addresses made from the same seed phrase still trace back to the same master key. His advice was to create a new seed phrase on a secure device and transfer assets to wallets linked to that new phrase.