A recent asset-loss incident involving Ledger users has renewed scrutiny of hardware wallet security, according to OneKey founder Yishi. In a public post, Yishi said the main risk may not lie in the secure element itself, but in the gap between the protected chip and the display that users trust — what he described as the "last inch" of the security chain. He argued that hardware wallet protection needs to cover the full process, including manufacturing, shipping, storage, and distribution, rather than focusing on a single component.
Yishi also urged users to buy devices through official channels, inspect packaging, and complete official verification steps. He noted that sensitive data may be exposed during transmission. As of Oct. 10, he said, OneKey had not received any reports of user fund losses tied to the incident. In response to supply-chain attack risks, the company plans changes across packaging, mnemonic display paths, motherboard communications, dealer authorization, and user verification information. OneKey also plans to introduce a backup process that does not require showing the recovery phrase on the device screen, while prioritizing stronger encryption for sensitive internal motherboard communications to reduce the risk of hardware implants extracting recovery phrases.
Odaily reported that OneKey founder Yishi said a recent asset-loss incident involving Ledger users has drawn fresh attention from the crypto community to hardware wallet security.
Yishi said the risk may not come from the secure element itself. Instead, he pointed to the space between the protected chip and the display trusted by the user, describing it as the "last inch" of the security process. In his view, hardware wallet security needs to extend across the full chain of manufacturing, shipping, storage, and distribution.
User guidance from OneKey
Yishi advised users to purchase devices through official channels, inspect the packaging, and complete official verification. He also said sensitive data may be exposed during transmission.
Status as of Oct. 10
Yishi said that as of Oct. 10, OneKey had not received any reports of users losing funds as a result of the incident.
Planned security changes
To address supply-chain attack risks, OneKey plans improvements in several areas, including packaging, the mnemonic display path, motherboard communications, dealer authorization, and user verification information.
Among the planned changes, OneKey said it will introduce a backup process that does not require the recovery phrase to be shown on the device screen. The company will also prioritize stronger encryption for sensitive internal communication links on the motherboard to reduce the risk that hardware implants could obtain recovery phrases.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
