Using an older iPhone as an offline cryptocurrency wallet may expose digital asset holders to security risks that cannot be eliminated simply by deleting personal data or disconnecting the device from the internet, according to OneKey founder Yishi Wang, whose company develops dedicated hardware wallets for cryptocurrency storage.

Wang issued the warning after several public demonstrations of iPhone jailbreak techniques emerged over the past two weeks. He highlighted potential hardware-level vulnerabilities affecting the iPhone 11 and earlier models, including the second-generation iPhone SE, raising concerns about the safety of devices repurposed for cryptocurrency cold storage.

At the center of the issue are vulnerabilities in Apple's BootROM, the low-level firmware responsible for initiating a device's startup process. The BootROM is written into read-only memory during chip manufacturing, leaving no mechanism to rewrite it through software once a device has shipped. Unlike conventional software weaknesses, these flaws cannot be resolved through regular iOS updates, which means that installing the latest available operating system does not necessarily eliminate the underlying security exposure.

Why Airplane Mode and Factory Resets May Not Be Enough

Older smartphones are sometimes repurposed as cold wallets because they can be kept permanently offline and separated from the devices used for everyday internet access. The approach is intended to reduce exposure to remote attacks and to protect private cryptocurrency keys from online threats, and it is sometimes discussed as an alternative to dedicated hardware wallets, which are purpose-built devices for keeping private keys offline.

Wang's warning challenges the assumption that an iPhone becomes sufficiently secure for cold storage merely by wiping its contents and enabling airplane mode. According to Coin Bureau, the security concern he outlined is that BootROM vulnerabilities exist below the operating system level. As a result, removing applications, resetting the device, or disabling wireless connectivity does not address the underlying hardware-related weaknesses.

This distinction is particularly important for cryptocurrency holders because the security of a cold wallet depends on protecting the private keys that authorize transactions. If an attacker gains access to a device at a sufficiently privileged level, the isolation provided by conventional offline settings may not deliver the protection users expect.

The Risk of an "Evil Maid" Attack

One scenario highlighted by Wang is known as an "evil maid" attack, a threat model long recognized in information security, in which an attacker gains temporary physical access to a device without the owner's knowledge. For example, someone could access an iPhone while its owner is away or after borrowing the device, and may attempt to compromise its security before returning it. The phone could subsequently appear normal, leaving the owner unaware that its integrity may have been affected.

This type of threat is particularly relevant to cryptocurrency storage because users may assume that a device kept in a private location remains secure as long as it never connects to the internet.

Specialized USB Tools Could Exploit Pre-Boot Vulnerabilities

A further concern involves the use of specialized USB equipment to execute code before iOS begins running. According to the warning, an attacker could potentially exploit the BootROM vulnerabilities during a device's startup process. Importantly, this scenario does not require an internet connection, meaning that conventional precautions focused on disabling Wi-Fi or cellular connectivity may not be sufficient to prevent this particular category of attack.

Caveats and Key Takeaway

The warning does not establish that every older iPhone has been compromised, or that all devices are equally exposed. However, it highlights a security limitation that cryptocurrency holders should consider before relying on aging Apple hardware to protect valuable digital assets.

With the identified BootROM flaws affecting the iPhone 11 and earlier models, including the second-generation SE, the central concern is that an offline device is not automatically a secure cold wallet when its underlying hardware remains vulnerable.

The warning was originally reported by Victoria Hale at Hokanews.