onekey

The security team of the open-source wallet provider OneKey successfully replicated the exploitation of a vulnerability in the old version of the Ledger Ethereum application in a laboratory environment. OneKey's founder and CEO Wang Yishi stated that they executed a "transaction replacement attack" on Ledger Ethereum application version 1.22.1 by exploiting a previously patched vulnerability, allowing attackers to overwrite pending transactions while users review legitimate transactions.Ledger responded that exploiting this vulnerability requires controlling the communication between the device and the host, such as through malware, compromised wallet software, or malicious web pages. Ledger has added application layer protections in the Ethereum application version 1.22.2 released on August 13 and fixed the underlying issue in Secure SDK 26.6.1 on August 21. Ledger emphasized that no users were hacked as a result; this was merely a replication of the vulnerability in a laboratory environment.This security test occurred after the Coldcard vulnerability incident. Previously, the Coldcard wallet had a firmware vulnerability that posed security risks to some mnemonic phrase generation, but Ledger stated that its devices were not affected by this vulnerability because recovery phrases are generated by a certified random source built into the device's secure chip. The vulnerability replicated by OneKey is unrelated to mnemonic phrase generation but affects the way transactions are processed during the signing process.

OneKey founder Yishi posted on platform X: "Pay attention to the short OI (open interest) congestion around 75,000. Once a crowded short + passive delta buying from market makers creates positive feedback, a classic gamma squeeze may occur, where short liquidity reverses and becomes fuel for the bulls."

ChainCatcher news, according to OneKey's Chinese Twitter, regarding the recent "Milk Sad incident" involving a random number vulnerability, the OneKey team clarifies that this vulnerability does not affect the security of the mnemonic phrases and private keys of OneKey's software and hardware wallets.The vulnerability originates from the Libbitcoin Explorer (bx) version 3.x, which uses a pseudo-random number generator based on system time and the Mersenne Twister-32 algorithm, with a seed space of only 2³² bits. Attackers can derive private keys through prediction or brute force. The affected range includes some older versions of Trust Wallet and all products using bx 3.x or older versions of Trust Wallet Core. OneKey states that its hardware wallets use EAL6+ secure chips with built-in TRNG true random number generators; older devices also pass SP800-22 and FIPS140-2 entropy tests; the software wallet uses system-level CSPRNG entropy sources to generate random numbers, meeting cryptographic standards. The team emphasizes that users are advised to manage assets using hardware wallets and should not import mnemonic phrases generated by software wallets into hardware wallets to ensure the highest level of security.

ChainCatcher message, Curve ecosystem contributor haowi.eth posted on the X platform stating: "Recently, Onekey and its founder Wang Lei (also known as yishi) issued a joint statement accusing me of making false statements regarding the so-called Resupply vulnerability incident. This incident has triggered a series of personal attacks and false accusations. This matter is unrelated to any DeFi project or industry risk. I deny the joint statement publicly issued by Onekey and Wang Lei, as well as the subsequent remarks. Making unfounded or unsubstantiated statements is meaningless. I have not been legally sanctioned in any country. Any statements should be based on irrefutable facts. I reserve all rights and will take action based on my judgment. As a member and investor of the Curve community, I express my views and facts to defend my own and other investors' legitimate rights and interests. I will actively protect my rights through legal means and will not tolerate any malicious defamation and personal attacks."haowi.eth stated that Yishi and 3D previously accused Curve of being the problem on Twitter due to losses in the Resupply insurance pool and made many irresponsible remarks, to which he refuted one by one, and then received a lawyer's letter a couple of days ago.

ChainCatcher message, OneKey founder Yishi posted a warning on platform X, advising users to upgrade their iOS and macOS to the latest version as soon as possible. Apple has a high-risk 0-day vulnerability in the wild, which is not a PoC; it is being used to exploit CVE-2025-43300. The vulnerability works by sending a specially crafted image to the user, which can lead to out-of-bounds read and write of the user's device memory, potentially resulting in direct remote RCE. There are already reports of payloads being executed.In the comments, a user used Grok for verification, and Grok replied: "CVE-2025-43300 is a real Apple zero-day vulnerability affecting iOS, iPadOS, and macOS. Processing malicious images can lead to out-of-bounds writes and potential remote code execution. Apple has confirmed reports of sophisticated attacks targeting specific individuals and released an update in August 2025 to fix it (e.g., iOS 18.6.2). Immediate updates are recommended. Source: Apple Support page, NVD, and security reports."

ChainCatcher news, OneKey founder Yishi posted a screenshot of being blacklisted by Curve Finance with the caption "Graduated."Previous report, OneKey founder Yishi spoke out about the Resupply attack incident, calling on projects like Curve to refund user losses.

ChainCatcher message, the encryption wallet provider OneKey released a statement in its X community stating that it has never incited, organized, or manipulated any KOL or user in any form to launch public opinion attacks against Curve or any project. In response to the malicious accusations and false statements spread by certain individuals on current social platforms, OneKey will pursue legal accountability and will not tolerate such behavior.In addition, founder Yishi is participating in the investment entirely in a personal capacity, which is a personal action, and no official resources from OneKey have been involved in this project.At the same time, all products of OneKey are designed to be open source, with no backdoors, and have been fully audited by professional security teams such as SlowMist.

ChainCatcher news, OneKey founder Yishi tweeted, "So far, I haven't seen Resupply take any action to alert or track down the hackers, not even bothering to put on a show by calling for the hackers to return the stolen funds. Instead, they are directly targeting the victim users. Their first reaction after being Rugged was to reach into the users' pockets for money, extending the unlocking period, preventing withdrawals, and various insults towards users in the community, kicking people out, muting, and racial discrimination... After so many years in DeFi, I've really opened my eyes, there's your kind."In addition, SlowMist founder Yu Xian added, "The project party is the first known in history to not make any statements or offer bounties. If I were the attacker, I would also be confused. Why hasn't the project party made a statement yet? Am I a black hat hacker or a white hat?"

ChainCatcher news, OneKey founder Yishi publicly stated about "Curve ecosystem DeFi protocol Resupply suffering a price manipulation attack resulting in a loss of $9.6 million," demanding that Curve provide a fair solution for every investor and return the user funds lost due to serious technical errors by the project team.Yishi revealed that he is one of the three major investors in Resupply, and the losses from this incident amount to millions of dollars. He accused the team of banning reasonable questioners on Discord and lacking the necessary accountability. He emphasized that the vulnerability stemmed from the failure to destroy the initial shares when deploying the ERC4626 vault, allowing attackers to mint shares at almost zero cost and drain the vault, which constitutes a protocol-level design and deployment error.Yishi stated that it is unreasonable for the Resupply team to shift the losses onto the insurance pool depositors, as the insurance pool is meant for black swan events and market fluctuations, not to cover the team's technical negligence. He also pointed out that Curve, Convex, and Yearn had participated in supporting Resupply in various forms and had gained actual benefits from it, and should not shirk responsibility afterward. He called for the relevant parties to bear the necessary costs and return user assets.In response to the incident, Curve stated this morning, "Although Resupply was not developed by the Curve team, its creators are experienced, and we believe they will do their best to address the issue. The insurance pool is intended to provide protection for such security incidents, and any recovered assets should be prioritized for processing."

ChainCatcher news, according to official sources, YZi Labs recently announced an investment in the open-source hardware wallet project OneKey, aiming to enhance the security of global crypto assets and promote self-custody solutions.

ChainCatcher news, the decentralized AI training platform FLock.io has officially reached a strategic partnership with hardware wallet provider OneKey to jointly launch an AI model training challenge focused on smart contract security. This collaboration will integrate FLock's federated learning architecture with OneKey's expertise in blockchain security to jointly promote the upgrade of industry security standards.This challenge is built on the training framework of FLock's core module AI Arena, utilizing an audited real vulnerability dataset, along with a dynamic attack and defense scenario simulation question bank. Participants can engage in the competition by optimizing detection algorithms, contributing threat intelligence, validating model effectiveness, and more, competing for $FLOCK token rewards and OneKey hardware wallets.In addition, the project team has specially opened the "Elite Trainer Program" registration channel, inviting global security engineers and AI developers to collaboratively create efficient and accurate smart contract security detection models.

ChainCatcher news, according to official sources, OneKey, Virtuals Protocol, and Pendle have now integrated the OKX DEX API, aiming to provide customers with convenient trading features and enjoy the seamless trading experience, low slippage, better quotes, and improved liquidity offered by OKX DEX. The goal of the OKX DEX API is to become the developer's first choice and the industry standard by providing industry-leading API solutions, while promoting the expansion and diversification of the OKX DEX aggregator ecosystem.It is reported that OneKey is a leading open-source hardware wallet brand. Since 2020, OneKey has been committed to providing comprehensive self-custody wallet solutions for cryptocurrencies, having provided secure hardware wallet devices and its self-developed OneKey App multi-chain software wallet services to users from over 100 countries. Virtuals Protocol is a framework designed for creating, owning, and expanding tokenized AI agents, aimed at managing and coordinating the AI agent functionalities used in various consumer applications. Pendle is a permissionless yield trading protocol that allows users to execute various yield management strategies.

ChainCatcher message, OneKey's official X account has issued a reminder that some users have experienced login attempts on their Dexx account email. If you have logged into Dexx, remember to change your Web2 password.If you use the same password for your email and the Dexx trading platform, we recommend that you change the passwords for all associated Web2 accounts that use the same password as soon as possible.It is best to abandon this password altogether. This will prevent further breaches by Dexx insiders or hackers, especially if your email contains sensitive information and is linked to multiple account authentications.

ChainCatcher message, OneKey's official Chinese account posted on social media that DEXX may have uploaded users' clipboard content.It has received feedback that the app repeatedly requests "upload user clipboard content" permission. If users have copied private key mnemonic phrases on their phones, they may need to transfer their assets as soon as possible.

ChainCatcher news, the open-source hardware wallet OneKey announced that it will gradually discontinue the current OneKey Card service.The specific discontinuation schedule is as follows:Phase One (September 30, 2024): Users can continue to spend and withdraw normally, while the registration and recharge functions will be discontinued.Phase Two (October 31, 2024): All cards will be automatically deleted by the system, and the balance of the cards will be transferred to the OneKey Card wallet account, which can be withdrawn to an exchange account or Web3 address at any time.Phase Three (January 31, 2025): The OneKey Card service will be stopped.

ChainCatcher message, OneKey Open Source Wallet stated on platform X that due to sudden changes in bank interest rates, fees have unexpectedly increased, and this is to inform about the new changes in advance.Details of the rate adjustment: Card numbers starting from 404038, 485997, and 556150 are affected; non-US dollar or transactions outside the US are affected; the new rate adds 1% plus $0.50 per transaction. For transactions between 08:00 Beijing time on October 31 and 08:00 on November 4, OneKey will compensate for the additional fees within 2 weeks.

ChainCatcher news, according to the official OneKey hardware wallet, starting from September 31, 2023, OneKey Card will stop accepting new user applications from the following countries or regions: Iran, North Korea, Syria, Russia, North Macedonia, mainland China, Sudan, Venezuela, and Zimbabwe.Users who have already activated their cards are not affected and can continue to use them normally. It is reported that this move is to strictly comply with local laws and regulatory requirements.