Untethered iPhone 18 Pro Jailbreak Survives Reboot at Hexacon

Hacker Calif demonstrated an untethered jailbreak of an iPhone 18 Pro running iOS 27.0.1 on stage at Hexacon in Paris. The jailbreak survived a reboot, which researchers treat as the minimum bar for defeating Apple's secure boot chain, and no tool, bug or target build was made public. Nothing usable shipped with the demo.

What happened at Hexacon in Paris

Hexacon is an annual mobile security conference in Paris where researchers present working exploits on stage rather than on slides, a format built around live demonstration. Calif's session showed an iPhone 18 Pro jailbroken during the talk and still unlocked after the device restarted. The presentation stopped there. No exploit code, no vulnerability name, no release date, no explanation of which component gave way.

No code, no vulnerability name, no release date. Nothing that lets an outsider verify any of it yet.

That is the normal shape of a conference demo, and it also means nothing is confirmed. A jailbreak surviving a restart is a meaningful signal, since faking persistence on screen does not survive an actual power cycle. It is not an audit. Confirming an iOS jailbreak means running the installer, checking that a package manager is present, confirming the kernel extension loaded, and sometimes repeating the process across an update. Until someone does that independently, this is a documented claim, not a distributed exploit.

What does an untethered jailbreak actually mean?

An untethered jailbreak stays applied after a restart with no computer attached, which is the version almost everyone outside the research world cares about. A tethered jailbreak drops the moment the phone reboots and has to be restored with a PC or a companion tool. A semi-untethered jailbreak survives reboots but not an erase or a system update, a design choice that deliberately leaves Apple's patched path open.

Tethered jailbreaks break on every reboot. Untethered ones do not, which is the whole difference.

What the unlocked system actually grants is the part worth knowing. With Apple's restrictions lifted, a user can install unsigned applications, load system-wide modifications commonly called tweaks, run a package manager, and reach the parts of the filesystem that are normally sealed. On a current iPhone that means kernel-level control, which is the difference between an inconvenience and a compromise. An attacker holding the kernel is not bound by what an app sandbox permits.

Why the iPhone 18 Pro generation matters

Recent Apple flagships have held out for years. Modern iOS boots a verified snapshot of a signed system volume, keeps hardware-backed keys in the Secure Enclave, and requires Apple-signed code before anything runs. Jailbreaks on the newest hardware have tended to arrive rootless, meaning they leave the read-only system partition alone and modify a writable copy instead, because patching the system in place stopped working years ago. An untethered jailbreak on a current Pro is a different kind of result from a port of an older technique.

A new flagship generation rarely opens the same door twice.

One distinction matters for reading the follow-up coverage. Some jailbreaks depend on a defect Apple can ship a patch for, and those windows close with the next point release. Others exploit the boot chain itself, or a flaw in hardware recovery mode that Apple cannot rewrite on devices already in circulation, and those persist across updates by design. Which one Calif found is not public. Reading an announced iOS 27.1 patch as the end of the story would be premature, and so would treating the capability as permanent.

What does this mean for crypto wallets on iPhone?

For a self-custody wallet on an iPhone, the exposure that matters is the seed phrase, and a jailbroken device puts that exposure one layer closer. A hostile operating system can log keystrokes, overlay fake interfaces on legitimate apps, read the clipboard where recovery phrases get pasted, and inspect what other applications store. Each is a known attack class against mobile wallets, and each is blocked by default on an intact iPhone, where the sandbox, the Secure Enclave and the code signing model all assume the OS is not hostile.

The target is the recovery phrase, not the app password.

Proportions matter here. What was shown is a research capability, not a campaign: no released tool, no malware package, and no sign of anyone using this against wallet holders. The realistic timeline is longer than a headline suggests, since these exploits tend to get weaponized after a working jailbreak becomes downloadable, not before. Hardware wallets sidestep the question entirely, since keys never sit in a phone's general storage, and some services already treat a jailbroken or unpatched device as a reason to block sensitive actions.

There is a second-order angle for desks that trade from a phone. A device with persistent kernel compromise can read price alerts, capture two-factor codes, and hold session cookies for exchange apps, none of which surfaces as a failed login. That is why device integrity checks, minimum patch levels and mobile device management policy became standard in institutional operations, and why this discovery shows up in a market where treasury teams watch endpoint risk far more closely than they did two years ago.

How iPhone jailbreaks got this scarce

Jailbreaking was once routine. Through much of the late 2000s and the 2010s, an iPhone shipped with the expectation that a tool would appear days or weeks after each major iOS release, and the era of Cydia, third-party package managers and jailbreak themes built a whole economy around weak points in Apple's model. The cadence slowed as Apple hardened the boot chain, expanded a bug bounty paying six figures and in some categories millions, and shipped hardware changes that closed classes of flaws for good.

Boot chain unlocks from 2019 and rootless jailbreaks in the early 2020s kept older chipsets alive, not the newest hardware.

That economics is why conference stages matter. When a researcher demonstrates first, the finding is public before the weapon is, and the gap between those two states is when others write the proof of concept, tooling gets packaged, and the researcher either ships a public jailbreak, sells the bug to Apple, or sits on it for a later talk. All three outcomes have precedent at events like Hexacon. Which one applies is the single most useful thing to watch, because it decides whether the average user ever installs anything from this.

What should traders watch next?

The first checkpoint is whether anything usable appears. A public tool with an installer, a supported build list and a stated device range is a different market fact from a video, and past jailbreaks have often shown a short delay between the talk and the first packaged release. The second checkpoint is Apple's patch timeline for iOS 27. A point release closing the path would compress the window, while silence would point to a flaw somewhere Apple cannot reach on hardware already shipped.

Expect copycats within weeks of any real release, as happened after past high profile jailbreaks.

Three follow-ups sit behind those two. Independent researchers reproducing the jailbreak and confirming persistence through an over the air update is what separates a genuine result from a stage demo. Public detail about the bug class matters too, since it tends to lift related findings. Then watch how exchanges, custodians and enterprise device policies respond. None of this moves a price chart. It is infrastructure, and infrastructure shows up in costs later.

No wallet balances moved today. The exposure right now is a tooling question.