News linked to both this project and an event.
Odaily reports: OnKey founder Yishi posted a warning on X platform that using older iPhones as cold wallets for crypto assets may pose security risks. iPhone 4S through iPhone X are affected by the checkm8 vulnerability in BootROM, and the usbliter8 vulnerability disclosed in June this year affects iPhone XS, XR, 11 series, and second-generation SE, all of which involve low-level boot code that cannot be fixed through iOS system updates. After gaining physical access to a device, attackers can execute code via the USB interface before iOS boots, and airplane mode cannot prevent such attacks.Yishi recommends against using iPhone 11 and earlier models for storing mnemonics. Users who have already used such devices to store mnemonics should generate entirely new mnemonics in a trusted environment and migrate their assets, rather than merely changing the wallet address under the original mnemonic. In addition, users should promptly update their systems, use more complex device and wallet passwords, avoid charging via public USB ports, and remain vigilant against physical attacks during periods when the device is out of their control for extended periods.Previously, OneKey founder Yishi had posted on X platform recommending users use iPhone as a cold wallet, but only recommended iPhone 17 or newer models.
community users noticed Kraken experienced a period earlier where trading or withdrawals were unavailable.Kraken officially posted at 10:42 announcing: "We are investigating an issue affecting spot and derivatives clients connecting to the platform and submitting orders through all web, mobile applications, and REST and WebSocket connections. We are working to resolve the issue and will provide updates as more information becomes available."At 11:42, Kraken posted another update on progress, stating the issue had been resolved.OneKey founder Yishi commented on the matter: "Looks like Kraken had an issue just now too. Trading and withdrawals were unavailable, and the entire exchange went into 'post-only' mode. It's recovered now, but it really gave me a scare. Right now, attacking is far easier than defending. We must devote all our efforts to security. Full 'fortress mode' engaged."
Odaily Report: OneKey founder Yishi posted that after a series of data breaches and supply chain attacks in the hardware wallet industry recently, OneKey is strengthening its existing security measures, stating that it has not experienced any security incidents and that these measures are being implemented proactively. OneKey has confirmed through the Shopify API that personal information such as customer names, emails, and shipping addresses in historical order records has been deleted, and has reduced the customer data retention period to a maximum of 30 days. Returns, warranties, and device verification will switch to methods that do not rely on long-term data retention. The retention policies of carriers such as FedEx and UPS are not controlled by OneKey; with customers' explicit consent, OneKey may separately retain privacy-processed email addresses solely for product updates and security patch notifications. OneKey's long-term goal is to migrate its e-commerce operations to its own infrastructure and reduce dependence on third-party platforms such as Shopify.
Odaily News: OneKey founder Yishi posted on X platform "How to Turn an iPhone into a Cold Wallet."Yishi stated: "I recommend using an iPhone 17 or newer, running iOS 27 or higher, and replacing the device with a new one every one to two years... I would not use an iPhone 16 or earlier as a device for long-term signing of important asset transactions. Even an iPhone 17 with iOS 27 is only the minimum configuration I can currently accept. For long-term custody of large amounts of funds, I prefer to use a dedicated signing device, which should have a transparent security design and be capable of continuous maintenance and on-device transaction verification. Its firmware, supply chain, and recovery process still require further review. Keeping the phone offline is a precautionary measure. But factors such as hardware, patch level, BFU/AFU status, passcode, and wallet key management determine the actual effectiveness of this precaution."
OneKey founder Yishi posted on X platform that in response to recent incidents where Ledger hardware wallets purchased by some users through CryptoBilis were found to have unauthorized hardware implanted, leading to asset theft, OneKey has not yet received any reports of its own users experiencing asset theft as a result. However, out of security concerns, OneKey has terminated CryptoBilis's authorized dealer status.OneKey also announced that it will immediately stop accepting new dealers and will re-conduct qualification reviews for all existing authorized dealers. Additionally, for users who purchased OneKey hardware wallets through CryptoBilis between March 1, 2026 and the date of this statement, regardless of device model or usage status, they may apply for a free replacement. The application deadline is December 31, 2026.Furthermore, Yishi advised users who have already used the affected devices to treat their original seed phrases as potentially compromised and to transfer their assets to wallets using new seed phrases as soon as possible, without waiting for replacement devices to arrive.
Odaily News: OneKey founder Yishi posted a statement saying that the recent asset loss incidents involving Ledger users have drawn community attention to the security of hardware wallets. The risk may not come from the secure chip itself, but rather from the gap between the protected chip and the display screen that users trust — the so-called "last centimeter." Hardware wallet security needs to cover the entire process of production, transportation, storage, and distribution. Users are advised to purchase devices through official channels, complete packaging inspections and official verification, as sensitive data may be exposed during transmission.Yishi stated that as of October 10, OneKey has not received any reports of user fund losses caused by this incident. In response to supply chain attack risks, the company plans to make improvements across multiple areas, including packaging, mnemonic phrase display pathways, motherboard communication, reseller authorization, and user verification information. Among these, OneKey will introduce a backup process that does not require displaying the mnemonic phrase on the device screen, and will prioritize strengthening encryption of sensitive internal communication links on the motherboard to reduce the risk of hardware implant attacks obtaining recovery phrases.
Odaily News: OneKey Anzen has reproduced the Ledger vulnerability and discovered that Ledger Ethereum app version 1.22.1 contains a transaction replacement vulnerability. When an affected user is attacked, the hardware screen still displays transaction A under review, but the device may sign transaction B, which the user never viewed. OneKey Anzen stated that the issue stems from a race condition between the transaction display logic and the underlying buffer, with the attack requiring the host side to already be compromised by a malicious DApp or intermediary software. Ledger's CTO previously responded that a fix had been rolled out approximately two weeks ago, and users simply needed to update the app. Public information shows that the official tag for version 1.22.2 on Ledger's GitHub appeared on August 24. Ledger's official website states that the issue has been fixed through app-level checksums and SDK-layer patches, with Ledger Secure SDK v26.6.1 released on August 21, and the related apps have been rebuilt and republished. Users need to update the app via Ledger Live — updating only the device firmware will not complete the fix. Ledger stated that there is currently no evidence that this vulnerability has been actively exploited.
Odaily News - Hardware wallet maker BitBox reports that credit card sales in August grew roughly 10x compared to the baseline of previous weeks, with the increase primarily driven by North America. Trezor and OneKey also confirmed rising sales during the same period, though neither disclosed specific figures.Trezor, BitBox, and OneKey have all re-reviewed their seed phrase generation, random number generator, entropy, and firmware verification processes. Trezor plans to conduct penetration testing on core firmware functions and publish related security audit reports. OneKey will strengthen reviews of security-critical code paths and transaction signing processes.Ledger CTO Charles Guillemet stated that AI-assisted attacks mean patch releases, vulnerability disclosures, and user education need to accelerate. Blockstream Jade has released a firmware update containing multiple fixes and recommends users simultaneously update their apps, operating systems, devices, routers, and home appliances. (Bitcoin.com News)