onekey

Основатель аппаратного кошелька OneKey Иши опубликовал сообщение, в котором говорится, что был запущен инструмент tampered.app для проверки, был ли аппаратный кошелек подвергнут подделке. Пользователи могут загружать фотографии печатных плат для проверки, поддерживаются OneKey, Ledger и Trezor, бесплатно, без регистрации, фотографии не сохраняются.Этот инструмент может пометить подозрительные аномалии, но нормальный результат не означает полной безопасности. Иши сообщил, что при тестировании на примерно 400 загруженных фотографиях точность превышает 95%.

Основатель бренда аппаратных кошельков OneKey Иши опубликовал сообщение, в котором говорится, что в последнее время несколько пользователей, купивших аппаратные кошельки Ledger через CryptoBilis, сообщили о краже активов. Ledger подтвердил, что на затронутых устройствах было установлено несанкционированное оборудование, причины и масштабы воздействия все еще находятся на стадии расследования. Поскольку CryptoBilis также продавал аппаратные кошельки таких брендов, как OneKey, OneKey прекратил их статус авторизованного дистрибьютора и с сегодняшнего дня прекращает добавление новых дистрибьюторов.OneKey проведет повторную проверку существующих дистрибьюторов, лицензии которых будут аннулированы, если не удастся подтвердить юридическое лицо или конечного бенефициара. Полный список авторизованных дистрибьюторов будет опубликован по завершении проверки. С 1 марта 2026 года до даты публикации заявления пользователи, купившие аппаратные кошельки OneKey через CryptoBilis, независимо от модели, активации или использования, могут подать заявку на бесплатную замену. Если оригинальная модель есть в наличии, будет заменено на новое устройство той же модели, если нет в наличии, будет предоставлено бесплатное обновление, отправка будет осуществляться напрямую из официального магазина OneKey, без необходимости возвращать старое устройство. Срок подачи заявок истекает 31 декабря 2026 года, заявки необходимо подавать через службу поддержки на официальном сайте OneKey или help.onekey.so, предоставив доказательства покупки, модель устройства и информацию о его использовании.OneKey напоминает, что неактивированные устройства следует временно не активировать и сразу подавать заявку на замену; пользователи, которые уже использовали устройство и имеют активы, должны проактивно считать старые мнемонические фразы потенциально скомпрометированными, как можно скорее создать новый кошелек с новой мнемонической фразой для переноса активов и не импортировать старую мнемоническую фразу в новое устройство.

Сообщение ChainCatcher, команда безопасности открытого кошелька OneKey успешно воспроизвела уязвимость старой версии приложения Ledger для Ethereum в лабораторных условиях. Основатель и CEO OneKey Ван Иши заявил, что они провели "атаку замены транзакции" на версии 1.22.1 приложения Ledger для Ethereum, используя ранее исправленную уязвимость, позволяя злоумышленнику перезаписывать ожидающие подписи транзакции во время проверки пользователем законной транзакции.Ledger ответила, что для эксплуатации этой уязвимости необходимо контролировать связь между устройством и хостом, например, с помощью вредоносного ПО, взломанного программного обеспечения для кошельков или вредоносных веб-страниц. Ledger добавила защиту на уровне приложения в версии 1.22.2 приложения для Ethereum, выпущенной 13 августа, и исправила основную проблему в Secure SDK 26.6.1, выпущенном 21 августа. Ledger подчеркивает, что ни один пользователь не пострадал от хакерских атак, это всего лишь воспроизведение уязвимости в лабораторных условиях.Данное тестирование безопасности произошло после инцидента с уязвимостью Coldcard. Ранее кошелек Coldcard имел уязвимость в прошивке, из-за которой возникали проблемы с безопасностью при генерации некоторых мнемонических фраз, но Ledger заявила, что их устройства не пострадали от этой уязвимости, так как фразы восстановления генерируются с помощью встроенного в устройство сертифицированного источника случайных чисел. Воспроизведенная OneKey уязвимость не связана с генерацией мнемонических фраз, а затрагивает способ обработки транзакций в процессе подписания.

OneKey founder Yishi posted on platform X: "Pay attention to the short OI (open interest) congestion around 75,000. Once a crowded short + passive delta buying from market makers creates positive feedback, a classic gamma squeeze may occur, where short liquidity reverses and becomes fuel for the bulls."

ChainCatcher news, according to OneKey's Chinese Twitter, regarding the recent "Milk Sad incident" involving a random number vulnerability, the OneKey team clarifies that this vulnerability does not affect the security of the mnemonic phrases and private keys of OneKey's software and hardware wallets.The vulnerability originates from the Libbitcoin Explorer (bx) version 3.x, which uses a pseudo-random number generator based on system time and the Mersenne Twister-32 algorithm, with a seed space of only 2³² bits. Attackers can derive private keys through prediction or brute force. The affected range includes some older versions of Trust Wallet and all products using bx 3.x or older versions of Trust Wallet Core. OneKey states that its hardware wallets use EAL6+ secure chips with built-in TRNG true random number generators; older devices also pass SP800-22 and FIPS140-2 entropy tests; the software wallet uses system-level CSPRNG entropy sources to generate random numbers, meeting cryptographic standards. The team emphasizes that users are advised to manage assets using hardware wallets and should not import mnemonic phrases generated by software wallets into hardware wallets to ensure the highest level of security.

ChainCatcher message, Curve ecosystem contributor haowi.eth posted on the X platform stating: "Recently, Onekey and its founder Wang Lei (also known as yishi) issued a joint statement accusing me of making false statements regarding the so-called Resupply vulnerability incident. This incident has triggered a series of personal attacks and false accusations. This matter is unrelated to any DeFi project or industry risk. I deny the joint statement publicly issued by Onekey and Wang Lei, as well as the subsequent remarks. Making unfounded or unsubstantiated statements is meaningless. I have not been legally sanctioned in any country. Any statements should be based on irrefutable facts. I reserve all rights and will take action based on my judgment. As a member and investor of the Curve community, I express my views and facts to defend my own and other investors' legitimate rights and interests. I will actively protect my rights through legal means and will not tolerate any malicious defamation and personal attacks."haowi.eth stated that Yishi and 3D previously accused Curve of being the problem on Twitter due to losses in the Resupply insurance pool and made many irresponsible remarks, to which he refuted one by one, and then received a lawyer's letter a couple of days ago.

ChainCatcher message, OneKey founder Yishi posted a warning on platform X, advising users to upgrade their iOS and macOS to the latest version as soon as possible. Apple has a high-risk 0-day vulnerability in the wild, which is not a PoC; it is being used to exploit CVE-2025-43300. The vulnerability works by sending a specially crafted image to the user, which can lead to out-of-bounds read and write of the user's device memory, potentially resulting in direct remote RCE. There are already reports of payloads being executed.In the comments, a user used Grok for verification, and Grok replied: "CVE-2025-43300 is a real Apple zero-day vulnerability affecting iOS, iPadOS, and macOS. Processing malicious images can lead to out-of-bounds writes and potential remote code execution. Apple has confirmed reports of sophisticated attacks targeting specific individuals and released an update in August 2025 to fix it (e.g., iOS 18.6.2). Immediate updates are recommended. Source: Apple Support page, NVD, and security reports."

ChainCatcher news, OneKey founder Yishi posted a screenshot of being blacklisted by Curve Finance with the caption "Graduated."Previous report, OneKey founder Yishi spoke out about the Resupply attack incident, calling on projects like Curve to refund user losses.

ChainCatcher message, the encryption wallet provider OneKey released a statement in its X community stating that it has never incited, organized, or manipulated any KOL or user in any form to launch public opinion attacks against Curve or any project. In response to the malicious accusations and false statements spread by certain individuals on current social platforms, OneKey will pursue legal accountability and will not tolerate such behavior.In addition, founder Yishi is participating in the investment entirely in a personal capacity, which is a personal action, and no official resources from OneKey have been involved in this project.At the same time, all products of OneKey are designed to be open source, with no backdoors, and have been fully audited by professional security teams such as SlowMist.

ChainCatcher news, OneKey founder Yishi tweeted, "So far, I haven't seen Resupply take any action to alert or track down the hackers, not even bothering to put on a show by calling for the hackers to return the stolen funds. Instead, they are directly targeting the victim users. Their first reaction after being Rugged was to reach into the users' pockets for money, extending the unlocking period, preventing withdrawals, and various insults towards users in the community, kicking people out, muting, and racial discrimination... After so many years in DeFi, I've really opened my eyes, there's your kind."In addition, SlowMist founder Yu Xian added, "The project party is the first known in history to not make any statements or offer bounties. If I were the attacker, I would also be confused. Why hasn't the project party made a statement yet? Am I a black hat hacker or a white hat?"

ChainCatcher news, OneKey founder Yishi publicly stated about "Curve ecosystem DeFi protocol Resupply suffering a price manipulation attack resulting in a loss of $9.6 million," demanding that Curve provide a fair solution for every investor and return the user funds lost due to serious technical errors by the project team.Yishi revealed that he is one of the three major investors in Resupply, and the losses from this incident amount to millions of dollars. He accused the team of banning reasonable questioners on Discord and lacking the necessary accountability. He emphasized that the vulnerability stemmed from the failure to destroy the initial shares when deploying the ERC4626 vault, allowing attackers to mint shares at almost zero cost and drain the vault, which constitutes a protocol-level design and deployment error.Yishi stated that it is unreasonable for the Resupply team to shift the losses onto the insurance pool depositors, as the insurance pool is meant for black swan events and market fluctuations, not to cover the team's technical negligence. He also pointed out that Curve, Convex, and Yearn had participated in supporting Resupply in various forms and had gained actual benefits from it, and should not shirk responsibility afterward. He called for the relevant parties to bear the necessary costs and return user assets.In response to the incident, Curve stated this morning, "Although Resupply was not developed by the Curve team, its creators are experienced, and we believe they will do their best to address the issue. The insurance pool is intended to provide protection for such security incidents, and any recovered assets should be prioritized for processing."

ChainCatcher news, according to official sources, YZi Labs recently announced an investment in the open-source hardware wallet project OneKey, aiming to enhance the security of global crypto assets and promote self-custody solutions.

ChainCatcher news, the decentralized AI training platform FLock.io has officially reached a strategic partnership with hardware wallet provider OneKey to jointly launch an AI model training challenge focused on smart contract security. This collaboration will integrate FLock's federated learning architecture with OneKey's expertise in blockchain security to jointly promote the upgrade of industry security standards.This challenge is built on the training framework of FLock's core module AI Arena, utilizing an audited real vulnerability dataset, along with a dynamic attack and defense scenario simulation question bank. Participants can engage in the competition by optimizing detection algorithms, contributing threat intelligence, validating model effectiveness, and more, competing for $FLOCK token rewards and OneKey hardware wallets.In addition, the project team has specially opened the "Elite Trainer Program" registration channel, inviting global security engineers and AI developers to collaboratively create efficient and accurate smart contract security detection models.

ChainCatcher news, according to official sources, OneKey, Virtuals Protocol, and Pendle have now integrated the OKX DEX API, aiming to provide customers with convenient trading features and enjoy the seamless trading experience, low slippage, better quotes, and improved liquidity offered by OKX DEX. The goal of the OKX DEX API is to become the developer's first choice and the industry standard by providing industry-leading API solutions, while promoting the expansion and diversification of the OKX DEX aggregator ecosystem.It is reported that OneKey is a leading open-source hardware wallet brand. Since 2020, OneKey has been committed to providing comprehensive self-custody wallet solutions for cryptocurrencies, having provided secure hardware wallet devices and its self-developed OneKey App multi-chain software wallet services to users from over 100 countries. Virtuals Protocol is a framework designed for creating, owning, and expanding tokenized AI agents, aimed at managing and coordinating the AI agent functionalities used in various consumer applications. Pendle is a permissionless yield trading protocol that allows users to execute various yield management strategies.

ChainCatcher message, OneKey's official X account has issued a reminder that some users have experienced login attempts on their Dexx account email. If you have logged into Dexx, remember to change your Web2 password.If you use the same password for your email and the Dexx trading platform, we recommend that you change the passwords for all associated Web2 accounts that use the same password as soon as possible.It is best to abandon this password altogether. This will prevent further breaches by Dexx insiders or hackers, especially if your email contains sensitive information and is linked to multiple account authentications.

ChainCatcher message, OneKey's official Chinese account posted on social media that DEXX may have uploaded users' clipboard content.It has received feedback that the app repeatedly requests "upload user clipboard content" permission. If users have copied private key mnemonic phrases on their phones, they may need to transfer their assets as soon as possible.

ChainCatcher news, the open-source hardware wallet OneKey announced that it will gradually discontinue the current OneKey Card service.The specific discontinuation schedule is as follows:Phase One (September 30, 2024): Users can continue to spend and withdraw normally, while the registration and recharge functions will be discontinued.Phase Two (October 31, 2024): All cards will be automatically deleted by the system, and the balance of the cards will be transferred to the OneKey Card wallet account, which can be withdrawn to an exchange account or Web3 address at any time.Phase Three (January 31, 2025): The OneKey Card service will be stopped.