Hardcore Tutorial: How to Turn Your iPhone into a Secure Cold Wallet?

Original Author: Yishi (@ohyishi, OneKey janitor)

Original Compilation: TechFlow

TechFlow Introduction: Disconnecting an iPhone from the network and using it as a cold wallet to store crypto assets sounds reasonable, but the author Yishi (a maintainer at OneKey) has drawn a hard line: at minimum an iPhone 17 or newer, running iOS 27 or above, and migrating to a newer device every one to two years. Going offline does not eliminate the risks that come with "someone physically obtaining this phone." The article covers border searches, mnemonic storage, the mobile forensics industry, the BFU/AFU key state, the USB attack surface, the difference between chip-off and decryption, wallet key management, and explains why the hardware floor should start at iPhone 17, finally presenting his own signing device configuration. The conclusion comes first: taking a phone offline is only one of many precautions. What truly determines the level of security is the hardware generation, patch version, BFU/AFU state, device passcode, and the wallet's own key management.

You can do this, but I would require at minimum an iPhone 17 or newer, running iOS 27 or higher, and migrating to a newer device every one to two years. I would not entrust large crypto holdings to an old iPhone running an outdated iOS.

This is my minimum requirement for this use case. It is not an Apple certification, nor does it mean that anything above this line is safe. The reason is straightforward: taking a phone offline does not eliminate the risks that come with "someone physically accessing it."

To understand these risks, look at what happens when a phone arrives at a border checkpoint or a forensics lab.

Border Searches Don't Require Your Phone to Be Online

In U.S. Customs and Border Protection's (CBP) fiscal year 2025 annual report, 55,318 electronic device searches were recorded: 50,922 basic searches and 4,396 advanced searches. The fiscal year ran from October 1, 2024 to September 30, 2025. These are search statistics, not 55,318 successfully cracked iPhones. CBP Statistics and Policy

A basic search typically involves an officer viewing content on the device. An advanced search involves connecting external equipment (wired or wireless) to copy or analyze its contents. A basic search may also include entering relevant information into CBP systems.

There is an easily overlooked detail in a January 2026 directive: merely using a device to make content available for inspection (including bypassing a passcode or defeating encryption) does not by itself constitute an "advanced" search under that policy. So the basic-versus-advanced dichotomy does not cleanly tally which phones encountered unlocking tools and which did not. This is the current policy definition, and it cannot tell us how every search in the previous fiscal year was actually conducted. CBP Directive 3340-049B, §3.4

Under CBP policy, an advanced search requires reasonable suspicion of a violation within its enforcement authority, or national security concerns, and supervisory approval. The directive also requires compliance with binding case law. These are agency rules, and they do not mean the legal standards are the same everywhere.

There are also practical details. A phone that cannot be inspected may be seized. CBP states that U.S. citizens will not be denied entry because a device cannot be inspected; for foreign nationals seeking entry, non-cooperation is weighed alongside other factors. The directive says searches should generally be conducted in the presence of the individual, but this does not mean the individual gets to watch the inspection process firsthand. CBP FAQ Directive, §5.1.6

The most relevant point for cold storage is that CBP policy limits inspection to information stored locally on the device. Officers must disable network connections, or ask travelers to disable them, to avoid retrieving remotely stored data. A phone is deliberately taken offline before its local contents are inspected. A locally saved photo or note does not become inaccessible just because Wi-Fi is off. Directive, §5.1.2

A lawful law enforcement inspection and theft are two different things. But the custody lesson is the same: you must account for the possibility that another person could inspect the data you carry with you.

A Mnemonic in Notes or Photos Is Still a Mnemonic

I would not photograph a recovery phrase, store it in Photos, and then call it cold storage just because the iPhone is offline. I would not paste it into an ordinary note either.

These files are still protected by iOS encryption and Data Protection; they do not necessarily sit in plaintext on the NAND. The problem is that once someone obtains this content, the secret is right there, readable as text or an image. The wallet's own passcode, transaction approval, and signing controls no longer stand between "that copy" and "someone reconstructing the wallet." If an additional recovery passphrase was used, that would still be required.

Locked Notes deserve a precise distinction. Apple supports locking notes with the device passcode or a separate custom password, and locked notes have additional encryption protection. A strong custom password is a different situation from an ordinary unlocked note. But it is still a general-purpose document store, and the authentication method matters: using the same device passcode does not give you a separate password. Apple also notes that after unlocking one note, other locked notes under the same account will also be unlocked within a few minutes. Apple: Lock Notes Apple: Notes Security

Similarly, the Hidden album and the Recently Deleted album use Face ID, Touch ID, or the device passcode. Hiding a photo does not equal adding an independent layer of protection to a recovery secret. Deleted photos are typically retained in Recently Deleted for 30 days. Turning off the network today does not revoke copies that may already have been synced or backed up. Apple: Delete or Hide Photos

If your recovery phrase has already been exposed, moving the same phrase to a better device will not repair that exposure. You need to generate a new wallet in a trusted environment, then verify recovery and do a small test transaction before moving funds on-chain.

Mobile Forensics Is a Mature Industry

Cellebrite, Magnet's Graykey, Oxygen, and China's SDIC Intelligence (the company behind Meiya Pico) all operate in the mobile forensics space. Their products and capabilities vary. Device access, passcode recovery, extraction, and analysis are different parts of this work; model, OS version, and device state determine which methods are available. Magnet Training Oxygen SDIC Intelligence

You will see the term FFS, meaning full file system extraction. It differs from a partial extraction, and both differ from recovering a lock screen passcode. Obtaining a file system copy does not mean every encrypted file inside has been decrypted.

Cellebrite's Spring 2026 briefing named iPhone 17 and iOS 26.3.1 in its expanded Inseyets support. Page 4 gives a narrower and more useful statement: Cellebrite Advanced Services (CAS) claims AFU access support for iPhone 11 through 16 devices running iOS 26 or higher. These are vendor capability claims, not proof that "every supported combination can extract every wallet secret." Cellebrite Briefing

In the same release announcement, Cellebrite said that 75% of devices received by North American forensics labs are locked. This is an intake statistic, not a 75% unlock success rate. But it does tell you that locked devices are routine work for this industry. Cellebrite Announcement

Graykey also has historical evidence. In November 2024, 404 Media reported based on internal documents that newer iPhones running iOS 18 and 18.0.1 could produce partial extractions. Public reporting did not specify exactly what each extraction contained. "Partial" does not mean private keys were recovered, but a lock screen clearly cannot be treated as evidence that "no data can be accessed." 404 Media Original Report

The most critical detail is whether the phone has ever been successfully unlocked since it booted up.

BFU and AFU Describe the State of the Keys

BFU is Before First Unlock. The phone has booted, but no one has entered the correct passcode yet. AFU is After First Unlock. Locking the screen again does not return it to BFU.

iOS organizes file protection around per-file keys, protection class keys, and the keybag. The first unlock makes certain protected class keys available. Some keys remain available after the screen locks so that background tasks can continue.

The important example is Class C: NSFileProtectionCompleteUntilFirstUserAuthentication. Apple's documentation states that its class key remains in memory after the screen is re-locked. It is also the default file protection class for third-party apps when no other class is specified. Class A behaves more strictly: under the system protection policy, its decrypted class key is discarded after the screen locks. Apple: Data Protection Classes

With the right exploit chain and privileges, AFU can therefore expose app data that the same attacker could not obtain under BFU. This is the useful "warm" state that forensic examiners try to preserve. A wallet may add stronger file protection, Keychain access controls, or its own encryption, so Class C does not prove that every wallet mnemonic is readable. It explains why pressing the lock button once is not enough to close the issue.

Apple has been narrowing this window. iOS 18 introduced inactivity reboot. Researcher Jiska Classen documented a 72-hour interval in the versions she tested and traced the timer to the Secure Enclave Processor (SEP). Her subsequent notes also described an earlier seven-day interval. The SEP tracks time since the last unlock and triggers a reboot; this is more than an ordinary background timer. These historical timers should not be assumed to apply to every subsequent iOS version. Classen's Reverse Engineering Analysis

A normal reboot returns the phone to BFU and clears some useful decrypted state. Forensic vendors are responding. Cellebrite's Spring 2026 release page says Safeguard Mode can maintain access after a reboot. Its public materials do not fully disclose the mechanism, preconditions, or the exact access retained on each device. This claim should be part of the discussion, but with these limitations attached. Cellebrite: Safeguard Mode

Apple wants to close the extraction window, and forensic vendors want to keep it open. That is why I power off a dedicated signing phone when storing it, and why I would never treat an auto-reboot feature as my entire custody solution.

When the Network Is Off, USB Is Still an Attack Surface

USB Restricted Mode (often abbreviated USBRM) limits wired data access on a locked device. It is an important barrier, but it has had vulnerabilities.

CVE-2025-24200 allowed a physical attack to disable USB Restricted Mode on a locked device. Apple fixed it in iOS 18.3.1 and said it may have been used in extremely sophisticated attacks against specific targets. Apple Security Advisory

Amnesty's investigation into the use of forensic tools in Serbia provided a concrete example of a related technique on Android. It documented reaching kernel drivers by emulating USB peripherals, with a chain involving CVE-2024-53104, CVE-2024-53197, and CVE-2024-50302. The relevant device classes included video, audio, and HID. Amnesty Technical Report

This is an Android exploit chain, not evidence that "these same bugs also affect iPhone." But the general technique is worth understanding: peripheral emulation → driver attack surface → kernel exploitation → privilege escalation → extraction. These are concrete stages of an attack, not security jargon.

Taking the phone offline reduces network exposure. It does not remove the physical interfaces, their drivers, or the software that enforces access restrictions.

Chip-Off Does Not Equal Decryption

This is where the iPhone's design deserves credit. The