Do Not Use Your iPhone as Hardware Wallet, OneKey Founder

The practice of wiping spare iPhones and using them offline as cryptocurrency cold wallets is popular among self-custody fans, but OneKey founder Yishi Wang has issued a security warning about this approach. He points out that even offline iPhones can be vulnerable to physical attacks due to flaws in their boot process.

Boot Process Vulnerabilities

Wang has identified security issues in several generations of iPhones, including the publicly documented checkm8 problem in older models and more recently reported low-level weaknesses in later devices. These vulnerabilities exist in the early stages of the boot process and don't require a malicious app to exploit.

Recommendations

Wang specifically advises against using iPhone 11-generation and older devices for storing recovery phrases. If a phrase may have been exposed, he recommends creating a completely new one using a trusted setup and moving funds to that wallet. He also stresses the importance of updated operating systems, long alphanumeric passcodes, and careful control of USB connections.

While dedicated hardware wallets also carry risks like counterfeits and compromised distribution channels, they are built to isolate signing keys and allow users to verify transaction details on the device itself. Wang suggests that even newer iPhones shouldn't be treated as equivalent to purpose-built signing devices when holdings are substantial and long-term.