A warning has been issued that resetting an unused iPhone and using it like a cryptocurrency hardware wallet could pose security risks. It noted that even if internet connections are cut, it may not be possible to block attacks via vulnerabilities in the device itself.

U.Today, a blockchain media outlet, reported on Nov. 1 that Yishi Wang (이시 왕), founder of crypto wallet company OneKey, pointed to security limits in storing a wallet recovery phrase on a spare iPhone.

The method involves resetting an unused iPhone, blocking WiFi and mobile connections, and storing the wallet recovery phrase inside the device. Crypto users who prefer self-custody have used it because it can reduce the risk of remote hacking by isolating it from the internet.

Wang stressed that keeping a device offline alone does not complete security. He said that if an attacker physically obtains the device, it may be possible to exploit internal vulnerabilities without an internet connection or installing malicious apps.

He particularly focused on the iPhone's initial boot process. Older iPhones have the Checkm8 bootrom vulnerability, and low-level security flaws have also been reported in some later generations, he said. Bootrom is the area that runs before the operating system when a device powers on. Vulnerabilities at this stage are difficult to fix with standard operating system updates alone.

Wang recommended not storing crypto wallet recovery phrases on iPhone 11 models and earlier devices. If there is a possibility that the recovery phrase has been exposed, he advised generating an entirely new recovery phrase and moving assets to a new wallet rather than continuing to use the existing wallet.

Creating only a new address while keeping the existing recovery phrase cannot be a fundamental solution. If the seed, which is the recovery phrase, is the same, access rights to the wallet connected to that seed also remain in place.

Still, a device vulnerability does not immediately lead to theft of a recovery phrase. Device encryption, strong passcodes and key management systems still make attacks difficult. Wang also stressed basic security practices such as keeping the latest operating system, setting a long alphanumeric passcode and controlling USB connections.

He previously pointed out that if asset holdings are large or intended for long-term storage, even a new iPhone should not be treated as having the same level of security as a dedicated hardware wallet. Dedicated hardware wallets differ from ordinary smartphones because they are designed to store signing keys separately and allow users to verify transaction details on the device's own screen.

Hardware wallets are also not a perfect security tool. The possibility remains that assets could be exposed through counterfeit devices, tampering during distribution, or poor recovery phrase management.

The core of this warning is that being offline and being securely stored do not necessarily mean the same thing. Cutting internet connections can reduce the risk of remote attacks, but it cannot eliminate vulnerabilities in the device's hardware and boot stage. It pointed out that users seeking to store cryptocurrency long term should consider dedicated devices designed for security purposes rather than simply using an unused smartphone.