OneKey

Changpeng Zha

2026-10-10 12:22:13

CZ urges users to protect assets, says he is not against hardware wallets or self-custody

Changpeng Zhao said users should pay attention to asset security, writing "Stay SAFU out there," according to ChainCatcher. He also clarified that he is not opposed to hardware wallets or self-custody. Zhao added that different wallets and products fit different use cases, and that their security implications and best practices are not the same. He also disclosed that YZi Labs has invested in hardware wallet projects including OneKey and SafePal, as well as mobile wallet products such as Trust Wallet. The remarks focused on user asset protection and Zhao’s position on wallet choices rather than endorsing a single storage method.

220

Changpeng Zha

2026-10-10 12:13:32

CZ says he is not opposed to hardware or self-custody wallets, cites YZi Labs investments

Changpeng Zhao said in a post on X that he is not opposed to hardware wallets or self-custody wallets, adding that different wallet types and products fit different use cases. He said each option also comes with its own security implications and best practices. Zhao also pointed to YZi Labs’ existing wallet investments. According to his post, the firm has invested in OneKey and SafePal, both described as hardware wallets, as well as Trust Wallet on mobile. The remarks framed wallet choice as a matter of use case rather than a single preferred model, while highlighting the range of products already backed by YZi Labs.

240

OneKey

2026-10-10 09:02:54

OneKey founder says Ledger incident has put focus on hardware wallet security, plans upgrades to the "last inch" of protection

A recent asset-loss incident involving Ledger users has renewed scrutiny of hardware wallet security, according to OneKey founder Yishi. In a public post, Yishi said the main risk may not lie in the secure element itself, but in the gap between the protected chip and the display that users trust — what he described as the "last inch" of the security chain. He argued that hardware wallet protection needs to cover the full process, including manufacturing, shipping, storage, and distribution, rather than focusing on a single component. Yishi also urged users to buy devices through official channels, inspect packaging, and complete official verification steps. He noted that sensitive data may be exposed during transmission. As of Oct. 10, he said, OneKey had not received any reports of user fund losses tied to the incident. In response to supply-chain attack risks, the company plans changes across packaging, mnemonic display paths, motherboard communications, dealer authorization, and user verification information. OneKey also plans to introduce a backup process that does not require showing the recovery phrase on the device screen, while prioritizing stronger encryption for sensitive internal motherboard communications to reduce the risk of hardware implants extracting recovery phrases.

360

OneKey

2026-10-10 09:20:18

OneKey outlines attack path in suspected Ledger supply-chain case, rolls out five security upgrades

OneKey founder Yishi has published an analysis of the recent case in which tampered Ledger devices were suspected of being used in a theft totaling about $90 million. He said the attackers may have opened the devices and inserted a cellular module, allowing them to intercept mnemonic phrase data shown on the screen and bypass the secure element to steal funds. In response, OneKey said it will introduce five security improvements, including upgraded anti-counterfeit packaging, an initialization process that does not require displaying information on the screen, and encrypted internal motherboard bus communications at both the firmware and hardware levels. Hardware wallet maker Trezor also responded, saying it has fully suspended device sales through the e-commerce platform CryptoBilis involved in the case and is actively investigating. Trezor added that, so far, it has not received any reports of fund losses or device abnormalities similar to the Ledger incident.

230

Wang Yishi

2026-09-19 15:31:42

OneKey founder Wang Yishi on crypto, AI security, Bybit and why growth has no ceiling

In a long-form interview on Blockchain 100, OneKey founder Wang Yishi traced his path from a civil engineering student buying Bitcoin on Taobao in 2013 to building a hardware wallet company in crypto. He said his first reason for buying BTC was simple: the price was rising. From there, he moved through ByteDance and Bixin before going all in on the industry. Wang said OneKey’s first major user wave came during DeFi Summer in 2020, when large users moved on-chain and wanted a safer and easier alternative to browser wallets and the more cumbersome Ledger setup. He argued that open source and verifiability mattered more over time than asking users to simply trust a product. He also spent significant time on security. Wang said AI has sharply reduced the time needed to find and chain vulnerabilities, citing work by OneKey’s Anzen Labs that took one engineer two weeks instead of two to three senior researchers working for two months. On the Bybit $1.5 billion theft, he described a case where the multisig contract, cold wallet and Ledger device each appeared sound on their own, but a compromised Safe frontend engineer and blind signing created the conditions for the loss. The interview also covered OneKey’s paid trial-based hiring process, AI-assisted hardware testing with robotic arms, and Wang’s idea of giving his child an early pool of capital to lose and learn from before adulthood.

610

OneKey

2026-09-18 01:37:12

OneKey founder Yishi Wang on AI-driven security, the Bybit hack, and how hardware wallets stay alive

OneKey founder Yishi Wang used a wide-ranging interview to map out how he entered crypto, how OneKey found its first users during DeFi Summer, and why he thinks AI has sharply compressed the timeline for both attackers and defenders. Speaking with Beca in an interview published by MarsBit, Wang said he first bought Bitcoin in 2013 while studying civil engineering, then later moved from ByteDance into crypto after deciding the industry offered faster feedback loops and a stronger personal conviction. He said OneKey’s early traction came in 2020, when larger on-chain users wanted hardware protection but found existing wallet setups cumbersome. Wang argued that local user experience improvements and open-source design helped OneKey win those users. He also described mistakes during the company’s growth phase, including nearly a year of product shortages and what he called premature design and over-optimization. A large part of the discussion focused on security. Wang said AI has cut the time needed to build a full attack chain from roughly two months with two or three senior researchers to two weeks with one security engineer in one recent case handled by OneKey’s Anzen Labs. He also walked through his reading of the $1.5 billion Bybit theft, saying the failure was not in the multisig contract, cold wallet, or Ledger device itself, but in a compromised Safe frontend engineer and a blind-signing flow that failed to show the real action being approved.

870

OneKey

2026-08-28 02:32:23

OneKey reproduces Ledger flaw that could cause signed transactions to differ from what users see

OneKey’s security team, OneKey Anzen, said it has reproduced the Ledger vulnerability previously disclosed by TestMachine and found a transaction replacement issue in Ledger’s Ethereum app version 1.22.1. In the described attack scenario, a user could still see transaction A on the hardware wallet screen while the device may actually sign transaction B, which the user never reviewed. OneKey said the root cause is a race condition between the transaction display logic and the underlying buffer, and that exploitation requires the host side to already be under the control of a malicious dApp or intermediary software. The disclosure timeline has also drawn attention. TestMachine flagged the issue on Aug. 22, and Ledger’s CTO said the next day that a fix had gone live about two weeks earlier and that users only needed to update the app, while urging the community not to "spread panic." Public information, however, shows the formal 1.22.2 tag on Ledger’s GitHub did not appear until Aug. 24. Ledger later said it fixed the issue through app-level validation and at the SDK layer, released Ledger Secure SDK v26.6.1 on Aug. 21, rebuilt and republished affected apps, and added that updating through Ledger Live is required because a firmware update alone is not enough.

1580

hardware wall

2026-08-26 18:16:05

BitBox says card-payment sales rose roughly 10x after Coldcard incident; Trezor and OneKey also report gains

Hardware wallet maker BitBox said its credit-card payment sales in August rose by about 10 times versus a baseline from the previous several weeks, with most of the increase coming from North America. Trezor and OneKey also confirmed higher sales over the same period, though neither company disclosed exact figures. After the Coldcard incident, Trezor, BitBox, and OneKey said they re-examined processes tied to mnemonic generation, random number generators, entropy, and firmware verification. Trezor plans penetration testing for core firmware functions and said it will publish the related security audit report. OneKey said it will step up reviews of security-critical code paths and transaction-signing procedures. Ledger CTO Charles Guillemet said AI-assisted attacks mean patch releases, vulnerability disclosure, and user education need to move faster. Blockstream Jade has already released a firmware update with multiple fixes and advised users to update their apps, operating systems, devices, routers, and home appliances as well.

1090