OneKey’s founder warns that resetting a spare iPhone and disconnecting it before storing a recovery phrase does not eliminate physical-access risks or device vulnerabilities. Encryption and strong device passcodes still matter, and a vulnerability does not by itself establish that a recovery phrase can be extracted. If a phrase has been exposed, creating another address from the same seed does not revoke access. This report is not an independent demonstration of a new attack, and dedicated wallets also retain counterfeit-device, supply-chain and seed-management risks.