Основатель OneKey предупредил о рисках хранения сид-фраз на старых iPhone

Хранение сид-фраз на iPhone 11 и более ранних моделях несет риски даже после сброса настроек и включения авиарежима. Эти устройства подвержены атакам через аппаратные уязвимости, которые нельзя устранить обновлением iOS, предупредил основатель производителя аппаратных кошельков OneKey Иши Ван.

Over the past two weeks iPhones have been publicly jailbroken more than once, and most people treated it as a bit of tech drama and scrolled on. I want to use it to talk about something that matters more to people in crypto: wiping an old iPhone, putting it in airplane mode and using it only to hold your seed phrase is not as safe as most people think. If it’s an iPhone 11 or older, the problem lives in the chip, and no iOS update will fix it. Quick recap of what happened. On October 16 at Hexacon in Paris, the Calif team jailbroke an iPhone 18 Pro running iOS 27.0.1 live on stage. The jailbreak survived a reboot, they had root, and they got past MIE, the hardware memory protection Apple added starting with the A19 specifically to stop spyware. In the same session they showed attacks that get in through a single click in Signal or iMessage. A week later, on the day iPhone Duo went on sale, they jailbroke that too. Apple shipped iOS 27.2 on October 26, and Calif says most of the bugs they used are now fixed. Then on October 30, Ikotas Labs, the Japanese team that just won Pwn2Own, posted that they had jailbroken 27.2 as well. Their video only shows swapped icons and the version number, though, so I’m treating it as unconfirmed for now. For most people on a recent phone who keep it updated, none of this is a reason to panic. Before chains like these get patched, they usually sit with spyware vendors and forensics companies, and the odds of an ordinary person being specifically targeted are low. Update to 27.2 and you’ve done what you need to. The people I actually want to warn are those using an old iPhone as a cold wallet. iPhone 4S through iPhone X have checkm8 in the BootROM, made public in 2019. This June, usbliter8 went public, covering the iPhone XS, XR, the 11 series and the 2nd-gen SE. The BootROM is boot code burned into the chip at the factory. Apple can’t patch it with a software update, so these devices will carry the hole for as long as they exist. Exploiting it doesn’t need a network either. Once someone has your phone in hand, they put it into DFU mode and plug in a custom USB board (the public research used a $5 Raspberry Pi Pico 2), and they can run their own code before iOS even boots. Airplane mode makes no difference here. I don’t want to overstate it. On models like the XS and 11, the BootROM bug alone won’t hand over your seed phrase, because your passcode and the Secure Enclave are still in the way. The trouble is that these remaining layers are exactly where people tend to cut corners: a 6-digit passcode, an iOS version years out of date with a pile of public n-days, a short wallet app password. On some older models, forensic tools use bugs like this to brute-force the passcode. And if your wallet app encrypts the seed with nothing but a short password, once that encrypted file is copied off, the attacker can take it home and keep guessing offline, with no attempt limit. Old iOS versions also have a charging port problem. ChoiceJacking, published in 2025, lets a malicious charger pose as a keyboard and approve the data-access prompt for you. Apple only closed that in iOS 18.4. One more thing about this kind of attack: when you get your phone back, nothing looks off. In security circles it’s called an evil maid attack. A hotel room, a security check, lending your phone to someone to charge — any time it’s out of your hands for a while, there’s an opening. A lot of people only find out their phone was touched after their assets are already gone. My advice: 1. Check which iPhone holds your seed phrase (Settings → General → About). If it’s an iPhone 11 or older, move to a newer model before storing a seed on it. 2. If you’ve already stored one there, no need to panic. When you get a chance, generate a brand-new seed phrase in an environment you trust and move your assets over. It has to be a whole new seed. A fresh address under the old seed won’t help. 3. If your phone has ever been out of your hands for a while, say held for inspection at a border, don’t wait. Migrate as in step 2 as soon as you can. 4. Update your daily iPhone to iOS 27.2 (Settings → General → Software Update). If you haven’t moved to 27 yet, install at least 26.7.2. 5. Switch to a long alphanumeric passcode (Settings → Face ID & Passcode → Change Passcode → Passcode Options). A 6-digit PIN has only a million possible combinations. Make your wallet app password longer too. 6. Carry your own charger. Don’t use public USB ports, random power banks or cables you don’t know. 7. If you hold a lot or are likely to be targeted, consider turning on Lockdown Mode (Settings → Privacy & Security → Lockdown Mode). It blocks wired connections while the phone is locked. 8. Any "iOS 27 jailbreak download," or any tutorial asking you to install a certificate or configuration profile, is a scam or malware. Neither Calif nor Ikotas has released any tools. If you like using an iPhone as a cold wallet, go with a newer model and keep it on the latest iOS. There’s no public BootROM exploit for the iPhone 12 or later, and if something does turn up, Apple can still fix it with an update. With really old devices, the risk sits in the chip itself, and updating iOS won’t get you around it.

— Yishi (@ohyishi) October 31, 2026

Предприниматель напомнил о двух уязвимостях смартфонов от Apple. Раскрытая в 2019 году checkm8 затрагивает поколения iPhone от 4S до X. Обнаруженная в июне 2026 года usbliter8 затрагивает чипы A12 и A13, которые используются в XS, XR, линейке 11 и SE второго поколения.

Оба эксплойта позволяют атаковать BootROM — начальный загрузочный код, записанный в чип при производстве. Он запускается до операционной системы и не меняется при установке ее обновлений.

Usbliter8 сохраняется на затронутых устройствах на протяжении всего срока их эксплуатации. В новых поколениях чипов этот механизм атаки уже не работает.

Для эксплуатации подобных ошибок злоумышленнику требуется физический доступ к смартфону и USB-подключение к специальному оборудованию. Соединение с интернетом при этом не требуется.

«Авиарежим здесь ничего не меняет», — подчеркнул Ван.

При этом usbliter8 сам по себе не раскрывает сид-фразу. Уязвимость не взламывает изолированную подсистему Secure Enclave, которая обеспечивает дополнительную защиту пользовательских данных.

По оценке основателя OneKey, риск увеличивают короткий код разблокировки, устаревшая iOS и слабый пароль приложения кошелька. Возможность добраться до средств зависит от сочетания этих факторов и способа хранения секретных данных.

Владельцам старых устройств предприниматель рекомендовал создать новую сид-фразу в доверенной среде и перевести активы на новый кошелек. Особенно это касается смартфонов, которые надолго оставались без присмотра.

«Нужна совершенно новая сид-фраза. Новый адрес на основе старой не поможет», — объяснил он.

Поводом для предупреждения стали октябрьские демонстрации взлома iPhone командой Calif. На конференции Hexacon исследователи показали несколько атак, включая сценарии через Signal и iMessage.

26 октября Apple выпустила iOS 27.2 с исправлениями множества уязвимостей, в том числе обнаруженных специалистами Calif. 

Напомним, специалисты SlowMist предупредили, что критические уязвимости PHP могут угрожать Web3-проектам через сайты, серверы и сервисы подписания транзакций.