Older iPhones Expose Crypto Recovery Phrases to USB Attacks
Boot-level flaws in checkm8 and usbliter8 reach iPhone 4S through 11 series, and iOS updates cannot fix them.
Updated on Nov. 1, 2026 in Cybersecurity
Live Poll
Do you trust your phone to keep your personal data secure?
OnKey founder Yishi warned crypto users against storing wallet recovery phrases on iPhone 11 and older models, citing boot-level flaws that cannot be fixed by iOS updates. The warning is a security advisory based on disclosed vulnerabilities, not a new product or service.
Why it matters
The checkm8 flaw affects iPhone 4S through iPhone X, and the usbliter8 vulnerability disclosed in June 2026 extends the risk to iPhone XS, XR and 11 series, and second-generation iPhone SE. Because these are boot-level flaws, they reach below iOS itself, which is why software patches cannot close them.
The vulnerabilities are described as boot-level flaws in the BootROM, the code that runs before iOS loads. The extraction does not provide measured exploit success rates or attack-time figures.
The players
OnKey
A cryptocurrency wallet company whose founder, Yishi, issued the warning about storing recovery phrases on affected iPhones.
Yishi
The founder of OnKey, who advised crypto users with older iPhones to create new recovery phrases and move assets.
The details
The BootROM is the first code a device runs when it powers on, before the operating system starts. An attacker with physical access can connect a phone by USB and run code at this stage, which means the attack executes before iOS loads its own protections. Because the flaw sits below the operating system, airplane mode does not prevent it, and generating a new wallet address from an existing recovery phrase does not remove the exposure. OnKey's Yishi therefore advised affected users to create new recovery phrases in a trusted environment and move their assets.
Timeline
The usbliter8 vulnerability was disclosed in June 2026.
Yishi published the warning against storing seed phrases on November 1, 2026.
The Tech Race
The checkm8 flaw established a boot-level attack path on older iPhones, and usbliter8 extends that path to the XS, XR and 11 series and second-generation iPhone SE. Because neither can be fixed by an iOS update, the competitive pressure on hardware security shifts toward device design rather than software patching.
Owners of iPhone 11 and older models who store crypto recovery phrases on the device face exposure that iOS updates cannot remove. The practical step the advisory describes is to create new recovery phrases in a trusted environment and move assets.
The takeaway
Treat any seed phrase stored on an affected iPhone as potentially exposed, since the flaw lives below iOS. Watch for any vendor or Apple response that addresses the BootROM flaw at the hardware level rather than in software.
Further reading
For the broader threat landscape behind boot-level device attacks, see Cybersecurity.
Live Poll
Do you trust your phone to keep your personal data secure?
