Over the past two weeks iPhones have been publicly jailbroken more than once, and most people treated it as a bit of tech drama and scrolled on. I want to use it to talk about something that matters more to people in crypto: wiping an old iPhone, putting it in airplane mode and using it only to hold your seed phrase is not as safe as most people think. If it's an iPhone 11 or older, the problem lives in the chip, and no iOS update will fix it. Quick recap of what happened. On October 16 at Hexacon in Paris, the Calif team jailbroke an iPhone 18 Pro running iOS 27.0.1 live on stage. The jailbreak survived a reboot, they had root, and they got past MIE, the hardware memory protection Apple added starting with the A19 specifically to stop spyware. In the same session they showed attacks that get in through a single click in Signal or iMessage. A week later, on the day iPhone Duo went on sale, they jailbroke that too. Apple shipped iOS 27.2 on October 26, and Calif says most of the bugs they used are now fixed. Then on October 30, Ikotas Labs, the Japanese team that just won Pwn2Own, posted that they had jailbroken 27.2 as well. Their video only shows swapped icons and the version number, though, so I'm treating it as unconfirmed for now. For most people on a recent phone who keep it updated, none of this is a reason to panic. Before chains like these get patched, they usually sit with spyware vendors and forensics companies, and the odds of an ordinary person being specifically targeted are low. Update to 27.2 and you've done what you need to. The people I actually want to warn are those using an old iPhone as a cold wallet. iPhone 4S through iPhone X have checkm8 in the BootROM, made public in 2019. This June, usbliter8 went public, covering the iPhone XS, XR, the 11 series and the 2nd-gen SE. The BootROM is boot code burned into the chip at the factory. Apple can't patch it with a software update, so these devices will carry the hole for as long as they exist. Exploiting it doesn't need a network either. Once someone has your phone in hand, they put it into DFU mode and plug in a custom USB board (the public research used a $5 Raspberry Pi Pico 2), and they can run their own code before iOS even boots. Airplane mode makes no difference here. I don't want to overstate it. On models like the XS and 11, the BootROM bug alone won't hand over your seed phrase, because your passcode and the Secure Enclave are still in the way. The trouble is that these remaining layers are exactly where people tend to cut corners: a 6-digit passcode, an iOS version years out of date with a pile of public n-days, a short wallet app password. On some older models, forensic tools use bugs like this to brute-force the passcode. And if your wallet app encrypts the seed with nothing but a short password, once that encrypted file is copied off, the attacker can take it home and keep guessing offline, with no attempt limit. Old iOS versions also have a charging port problem. ChoiceJacking, published in 2025, lets a malicious charger pose as a keyboard and approve the data-access prompt for you. Apple only closed that in iOS 18.4. One more thing about this kind of attack: when you get your phone back, nothing looks off. In security circles it's called an evil maid attack. A hotel room, a security check, lending your phone to someone to charge — any time it's out of your hands for a while, there's an opening. A lot of people only find out their phone was touched after their assets are already gone. My advice: 1. Check which iPhone holds your seed phrase (Settings → General → About). If it's an iPhone 11 or older, move to a newer model before storing a seed on it. 2. If you've already stored one there, no need to panic. When you get a chance, generate a brand-new seed phrase in an environment you trust and move your assets over. It has to be a whole new seed. A fresh address under the old seed won't help. 3. If your phone has ever been out of your hands for a while, say held for inspection at a border, don't wait. Migrate as in step 2 as soon as you can. 4. Update your daily iPhone to iOS 27.2 (Settings → General → Software Update). If you haven't moved to 27 yet, install at least 26.7.2. 5. Switch to a long alphanumeric passcode (Settings → Face ID & Passcode → Change Passcode → Passcode Options). A 6-digit PIN has only a million possible combinations. Make your wallet app password longer too. 6. Carry your own charger. Don't use public USB ports, random power banks or cables you don't know. 7. If you hold a lot or are likely to be targeted, consider turning on Lockdown Mode (Settings → Privacy & Security → Lockdown Mode). It blocks wired connections while the phone is locked. 8. Any "iOS 27 jailbreak download," or any tutorial asking you to install a certificate or configuration profile, is a scam or malware. Neither Calif nor Ikotas has released any tools. If you like using an iPhone as a cold wallet, go with a newer model and keep it on the latest iOS. There's no public BootROM exploit for the iPhone 12 or later, and if something does turn up, Apple can still fix it with an update. With really old devices, the risk sits in the chip itself, and updating iOS won't get you around it.

I suspect IBIT is already on North Korea’s shortlist. In February 2025, the attackers behind the Bybit hack compromised a Safe{Wallet} developer’s Mac through a malicious project disguised as legitimate Docker-related tooling. They had access for 17 days before the theft, giving them enough time to manipulate the transaction interface used by Bybit’s signers. The signers believed they were approving a legitimate transaction. Instead, they unknowingly authorized the theft of $1.5 billion from a cold wallet. The keys could stay offline while the signers approved a theft through a compromised interface. TRM Labs attributes the recent Binance incident with high confidence to TraderTraitor, the North Korean group also linked to Bybit and the theft of 4,502.9 BTC from DMM Bitcoin. Binance’s preliminary investigation points to a compromised DevOps engineer’s laptop as the entry point. Binance says there’s no evidence that private keys were leaked, while TRM’s analysis suggests the attackers may have gained control of the signing infrastructure. If confirmed, the attackers could have moved funds through a compromised approval process without extracting the keys. Now imagine the same thing happening to IBIT. BlackRock’s IBIT is the world’s largest Bitcoin ETF, holding roughly 815,000 BTC worth around $63 billion. Coinbase remains its active Bitcoin custodian. Although Anchorage Digital has been appointed as an additional custodian, the fund’s latest quarterly filing says there are currently no plans to transfer any Bitcoin there. That’s an extraordinary concentration of Bitcoin under one custodian. Regardless of how large or well-funded that provider is, a critical failure in its security infrastructure could put the entire fund at risk. A $6 billion theft would wipe out roughly 9.5% of IBIT’s assets, equivalent to around $4 per share at current valuations. Binance managed to freeze some stolen stablecoins. Bitcoin has no such mechanism, making stolen BTC far harder to recover. BlackRock doesn’t separately insure the Bitcoin held by the fund. Coinbase has disclosed $320 million in commercial crime insurance coverage, shared across its customers. Its custody agreement also limits liability to $100 million per cold storage address, with any recovery subject to contractual terms, liability determinations, and other conditions. If a major theft occurred and the fund couldn’t recover the Bitcoin or obtain sufficient compensation, the remaining losses would ultimately be borne by IBIT shareholders. Bitcoin ETFs have made owning Bitcoin much more accessible, and there’s real value in that convenience. But as more capital flows into these products, enormous amounts of Bitcoin are also being concentrated among a handful of custodians and the infrastructure they depend on. The larger these pools become, the more attractive they are to attackers. A compromise at any critical point could have consequences far beyond a single institution. And that’s why security has no finish line. Even the most sophisticated cold storage setup still depends on hardware, software, supply chains, signing workflows, and the people operating them. Keeping private keys offline is essential, but it doesn’t eliminate the risks surrounding the transaction approval process. Spread your assets across independent custody setups. Keep your private keys offline. Verify transaction details on a trusted device screen, independently of the computer initiating the transaction. Continuously review your security architecture, and build it around the assumption that some part of your infrastructure will eventually be compromised. There are no silver bullets in security, and no permanent guarantees. Stay vigilant, keep verifying, and never mistake a clean track record for proof that you’re safe. Bunker mode.

looks like kraken had issues just now too. couldn’t trade or withdraw, and the whole exchange was in post-only mode. it’s back now, but that scared the hell out of me. it’s way easier to attack than to defend right now. we’ve got to put all our focus on security. full fortress mode.

Binance has over $160B in latest reserves. Last year it did $34T in volume with 323M+ users and ~43% spot share, consistently the clear leader. SAFU holds ~15k BTC (>$1B). 2019 hack was fully covered was with no user losses. It’s been through the hardest regulation, hacks, and black swans, always rising like a phoenix every time. Binance will get through this. If Binance can’t, no one else can. 🙏

Following the recent data breaches and supply chain attacks across the hardware wallet industry, we’re taking additional steps to strengthen OneKey’s existing security practices and further protect our customers’ privacy. First, to be clear: OneKey has NOT experienced a security breach. We’re taking these measures proactively, before something happens. We’ve always had internal data security policies in place, including routine deletion of customer order records and personal information. Given what’s been happening across the industry, we’ve decided to go further. We’re tightening these policies and conducting another thorough review of our systems to make sure nothing has been overlooked. Here’s what we’re doing: 1. Reviewing and verifying the deletion of historical order data. We’ve already confirmed through Shopify’s API that the relevant historical order records have been deleted, including customer names, email addresses, physical shipping addresses, and other personal information. We’re now going through our other systems and integrations again to make sure our existing data deletion policies have been properly enforced, with nothing left behind. 2. Limiting customer data retention to a maximum of 30 days. For OneKey and every system under our control, we’ll do everything we can to ensure that personal information associated with an order is permanently deleted within 30 days. We’ll find alternative ways to handle returns, warranty claims, and device verification without keeping sensitive customer information longer than necessary. 3. Further reducing the risk of historical customer data being exposed. The historical order records we’ve deleted are no longer accessible through Shopify’s order API. We’re continuing to review how and where customer information is stored and accessed, with the goal of ensuring that even if an ecommerce platform is compromised, there is no unnecessary historical customer data left for an attacker to obtain. One important limitation: Shipping carriers such as FedEx and UPS have their own data retention policies, which are outside our control. We cannot guarantee that these providers follow the same 30-day policy. Our commitment is to minimize and remove personal information everywhere we have the ability to do so. For customers who explicitly opt in to our communications, we may separately retain a privacy-protected email address, without linking it to their identity, shipping address, or order history. It will only be used for product updates, security patches, and other important notifications. We’re also working toward moving our ecommerce operations to infrastructure we fully control, with the long-term goal of eliminating our dependence on Shopify and similar third-party platforms. There are still challenges to overcome, especially around platform security, data lifecycle management, access controls, and fraud prevention. We want to get these things right before making that transition. We believe one of the best ways to protect customer privacy is to collect as little data as possible, keep it for as little time as possible, and delete it as soon as it’s no longer needed. Security work is never finished. We’ll stay cautious, keep reviewing our practices, and do everything we can to protect our customers’ privacy and security.

Are hardware wallets worth the money? What if I don’t trust the companies that make them? Could I build my own? How cheaply could I do it? Where would I get the parts, and how would I put everything together? I kept seeing questions like these, so I put together DIY Wallet: a free, interactive guide to building your own hardware wallet using off-the-shelf parts and OneKey’s open-source code. The current build uses a Raspberry Pi Zero 2 W with pre-soldered headers, a small OLED screen, a microSD card, and a USB cable. Budget around $38–57 for the parts and about five hours to get it running. No soldering required. The guide walks you through what to buy, how to assemble it, and how to compile the firmware and OneKey desktop app yourself. Your recovery phrase is generated on the device itself, using the Pi’s hardware random number generator. Hope you find it useful. Get started for free 👉

It’s been a brutal year for the market, but we’re still investing heavily in product development and security. OneKey Pro 2 is out, and we have more hardware in the works. More on that soon. Our investment in security will be even higher this year than last. Our @OneKey_Anzen security lab’s research was accepted at Black Hat USA 2026. We’ve completed multiple rounds of firmware security audits for Pro 2, along with code reviews and hardening of SeedCard against fault injection and power loss attacks. We’re also continuing our work on open source, reproducible builds, independent third party audits, and security hardening across our software, firmware, and hardware supply chain. Following the establishment of our Anzen physical security lab, we’re preparing to deploy our own privately hosted AI models for security auditing and penetration testing by the end of this year. We want to find more vulnerabilities ourselves, before attackers do. Stay humble. Stay cautious. Never take security for granted. Security work is never finished, and we’ll keep doing it. I sincerely hope none of you ever have to deal with a hack.

If your iPhone or another iOS device is still running iOS 26.2 or an earlier iOS 26 release, pay attention. DarkSword is a powerful iOS exploit chain. Researchers have confirmed attacks targeting iOS 18.4 through 18.7.2, and some of the underlying vulnerabilities remained unpatched in iOS 26.2. The final fix only arrived with iOS 26.3. If your device is vulnerable and you happen to visit a malicious website exploiting DarkSword, this is pretty much what your iPhone could look like to an attacker. We’re talking about system level exploitation. Once an attacker gains sufficient privileges, the impact can extend far beyond the app where the attack started. Even if App A is the initial entry point, sensitive data in App B could also be exposed, including your crypto wallets. Be careful which apps you install and which links you open. Always update to the latest iOS version available for your device. If you’re staying on iOS 26, make sure you’re on at least 26.3. If you’re still on iOS 18, update to 18.7.7 or later. If you can’t update immediately, especially if you’re using an iPhone as a cold wallet or have multiple software wallets installed, such as MetaMask, Phantom, or others, I strongly recommend enabling Lockdown Mode. Here’s how: - Open Settings. - Go to Privacy & Security. - Scroll down and tap Lockdown Mode. - Tap Turn On Lockdown Mode, then Turn On & Restart. - Enter your passcode to confirm. Lockdown Mode will restrict certain features, but that’s a reasonable tradeoff when you’re storing significant crypto assets on your phone. And please remember, Lockdown Mode is no substitute for security updates. Keep your devices patched.

if u have questions about the authenticity of ur ledger device, please use this tool to perform an initial check or contact ledger support directly. appreciate ur understanding, as i won’t be able to respond to DMs abt this going forward bcuz it’s just too many.