onekey

Tin tức từ ChainCatcher, đội ngũ an ninh của nhà cung cấp ví mã nguồn mở OneKey đã thành công trong việc tái hiện lỗ hổng của ứng dụng Ethereum phiên bản cũ của Ledger trong môi trường phòng thí nghiệm. Người sáng lập và CEO của OneKey, Vương Nhất Thạch cho biết, họ đã thực hiện "tấn công thay thế giao dịch" đối với ứng dụng Ethereum phiên bản 1.22.1 của Ledger bằng cách khai thác một lỗ hổng đã được sửa trước đó, cho phép kẻ tấn công ghi đè lên giao dịch đang chờ ký khi người dùng xem xét giao dịch hợp lệ.Ledger đã phản hồi rằng việc khai thác lỗ hổng này cần phải kiểm soát được giao tiếp giữa thiết bị và máy chủ, chẳng hạn như thông qua phần mềm độc hại, phần mềm ví bị xâm nhập hoặc trang web độc hại. Ledger đã bổ sung bảo vệ ở tầng ứng dụng trong phiên bản ứng dụng Ethereum 1.22.2 phát hành vào ngày 13 tháng 8 và đã sửa chữa vấn đề cơ sở trong Secure SDK 26.6.1 vào ngày 21 tháng 8. Ledger nhấn mạnh rằng không có người dùng nào bị tấn công bởi hacker, đây chỉ là việc tái hiện lỗ hổng trong môi trường phòng thí nghiệm.Cuộc thử nghiệm an ninh này diễn ra sau sự kiện lỗ hổng Coldcard. Trước đó, ví Coldcard đã gặp phải vấn đề an ninh do lỗ hổng firmware dẫn đến việc một số cụm từ khôi phục được tạo ra có nguy cơ an ninh, nhưng Ledger cho biết thiết bị của họ không bị ảnh hưởng bởi lỗ hổng này, vì cụm từ khôi phục được tạo ra từ nguồn ngẫu nhiên được chứng thực tích hợp trong chip an toàn của thiết bị. Lỗ hổng mà OneKey tái hiện không liên quan đến việc tạo cụm từ khôi phục, mà ảnh hưởng đến cách xử lý giao dịch trong quá trình ký.

OneKey founder Yishi posted on platform X: "Pay attention to the short OI (open interest) congestion around 75,000. Once a crowded short + passive delta buying from market makers creates positive feedback, a classic gamma squeeze may occur, where short liquidity reverses and becomes fuel for the bulls."

ChainCatcher news, according to OneKey's Chinese Twitter, regarding the recent "Milk Sad incident" involving a random number vulnerability, the OneKey team clarifies that this vulnerability does not affect the security of the mnemonic phrases and private keys of OneKey's software and hardware wallets.The vulnerability originates from the Libbitcoin Explorer (bx) version 3.x, which uses a pseudo-random number generator based on system time and the Mersenne Twister-32 algorithm, with a seed space of only 2³² bits. Attackers can derive private keys through prediction or brute force. The affected range includes some older versions of Trust Wallet and all products using bx 3.x or older versions of Trust Wallet Core. OneKey states that its hardware wallets use EAL6+ secure chips with built-in TRNG true random number generators; older devices also pass SP800-22 and FIPS140-2 entropy tests; the software wallet uses system-level CSPRNG entropy sources to generate random numbers, meeting cryptographic standards. The team emphasizes that users are advised to manage assets using hardware wallets and should not import mnemonic phrases generated by software wallets into hardware wallets to ensure the highest level of security.

ChainCatcher message, Curve ecosystem contributor haowi.eth posted on the X platform stating: "Recently, Onekey and its founder Wang Lei (also known as yishi) issued a joint statement accusing me of making false statements regarding the so-called Resupply vulnerability incident. This incident has triggered a series of personal attacks and false accusations. This matter is unrelated to any DeFi project or industry risk. I deny the joint statement publicly issued by Onekey and Wang Lei, as well as the subsequent remarks. Making unfounded or unsubstantiated statements is meaningless. I have not been legally sanctioned in any country. Any statements should be based on irrefutable facts. I reserve all rights and will take action based on my judgment. As a member and investor of the Curve community, I express my views and facts to defend my own and other investors' legitimate rights and interests. I will actively protect my rights through legal means and will not tolerate any malicious defamation and personal attacks."haowi.eth stated that Yishi and 3D previously accused Curve of being the problem on Twitter due to losses in the Resupply insurance pool and made many irresponsible remarks, to which he refuted one by one, and then received a lawyer's letter a couple of days ago.

ChainCatcher message, OneKey founder Yishi posted a warning on platform X, advising users to upgrade their iOS and macOS to the latest version as soon as possible. Apple has a high-risk 0-day vulnerability in the wild, which is not a PoC; it is being used to exploit CVE-2025-43300. The vulnerability works by sending a specially crafted image to the user, which can lead to out-of-bounds read and write of the user's device memory, potentially resulting in direct remote RCE. There are already reports of payloads being executed.In the comments, a user used Grok for verification, and Grok replied: "CVE-2025-43300 is a real Apple zero-day vulnerability affecting iOS, iPadOS, and macOS. Processing malicious images can lead to out-of-bounds writes and potential remote code execution. Apple has confirmed reports of sophisticated attacks targeting specific individuals and released an update in August 2025 to fix it (e.g., iOS 18.6.2). Immediate updates are recommended. Source: Apple Support page, NVD, and security reports."

ChainCatcher news, OneKey founder Yishi posted a screenshot of being blacklisted by Curve Finance with the caption "Graduated."Previous report, OneKey founder Yishi spoke out about the Resupply attack incident, calling on projects like Curve to refund user losses.

ChainCatcher message, the encryption wallet provider OneKey released a statement in its X community stating that it has never incited, organized, or manipulated any KOL or user in any form to launch public opinion attacks against Curve or any project. In response to the malicious accusations and false statements spread by certain individuals on current social platforms, OneKey will pursue legal accountability and will not tolerate such behavior.In addition, founder Yishi is participating in the investment entirely in a personal capacity, which is a personal action, and no official resources from OneKey have been involved in this project.At the same time, all products of OneKey are designed to be open source, with no backdoors, and have been fully audited by professional security teams such as SlowMist.

ChainCatcher news, OneKey founder Yishi tweeted, "So far, I haven't seen Resupply take any action to alert or track down the hackers, not even bothering to put on a show by calling for the hackers to return the stolen funds. Instead, they are directly targeting the victim users. Their first reaction after being Rugged was to reach into the users' pockets for money, extending the unlocking period, preventing withdrawals, and various insults towards users in the community, kicking people out, muting, and racial discrimination... After so many years in DeFi, I've really opened my eyes, there's your kind."In addition, SlowMist founder Yu Xian added, "The project party is the first known in history to not make any statements or offer bounties. If I were the attacker, I would also be confused. Why hasn't the project party made a statement yet? Am I a black hat hacker or a white hat?"

ChainCatcher news, OneKey founder Yishi publicly stated about "Curve ecosystem DeFi protocol Resupply suffering a price manipulation attack resulting in a loss of $9.6 million," demanding that Curve provide a fair solution for every investor and return the user funds lost due to serious technical errors by the project team.Yishi revealed that he is one of the three major investors in Resupply, and the losses from this incident amount to millions of dollars. He accused the team of banning reasonable questioners on Discord and lacking the necessary accountability. He emphasized that the vulnerability stemmed from the failure to destroy the initial shares when deploying the ERC4626 vault, allowing attackers to mint shares at almost zero cost and drain the vault, which constitutes a protocol-level design and deployment error.Yishi stated that it is unreasonable for the Resupply team to shift the losses onto the insurance pool depositors, as the insurance pool is meant for black swan events and market fluctuations, not to cover the team's technical negligence. He also pointed out that Curve, Convex, and Yearn had participated in supporting Resupply in various forms and had gained actual benefits from it, and should not shirk responsibility afterward. He called for the relevant parties to bear the necessary costs and return user assets.In response to the incident, Curve stated this morning, "Although Resupply was not developed by the Curve team, its creators are experienced, and we believe they will do their best to address the issue. The insurance pool is intended to provide protection for such security incidents, and any recovered assets should be prioritized for processing."

ChainCatcher news, according to official sources, YZi Labs recently announced an investment in the open-source hardware wallet project OneKey, aiming to enhance the security of global crypto assets and promote self-custody solutions.

ChainCatcher news, the decentralized AI training platform FLock.io has officially reached a strategic partnership with hardware wallet provider OneKey to jointly launch an AI model training challenge focused on smart contract security. This collaboration will integrate FLock's federated learning architecture with OneKey's expertise in blockchain security to jointly promote the upgrade of industry security standards.This challenge is built on the training framework of FLock's core module AI Arena, utilizing an audited real vulnerability dataset, along with a dynamic attack and defense scenario simulation question bank. Participants can engage in the competition by optimizing detection algorithms, contributing threat intelligence, validating model effectiveness, and more, competing for $FLOCK token rewards and OneKey hardware wallets.In addition, the project team has specially opened the "Elite Trainer Program" registration channel, inviting global security engineers and AI developers to collaboratively create efficient and accurate smart contract security detection models.

ChainCatcher news, according to official sources, OneKey, Virtuals Protocol, and Pendle have now integrated the OKX DEX API, aiming to provide customers with convenient trading features and enjoy the seamless trading experience, low slippage, better quotes, and improved liquidity offered by OKX DEX. The goal of the OKX DEX API is to become the developer's first choice and the industry standard by providing industry-leading API solutions, while promoting the expansion and diversification of the OKX DEX aggregator ecosystem.It is reported that OneKey is a leading open-source hardware wallet brand. Since 2020, OneKey has been committed to providing comprehensive self-custody wallet solutions for cryptocurrencies, having provided secure hardware wallet devices and its self-developed OneKey App multi-chain software wallet services to users from over 100 countries. Virtuals Protocol is a framework designed for creating, owning, and expanding tokenized AI agents, aimed at managing and coordinating the AI agent functionalities used in various consumer applications. Pendle is a permissionless yield trading protocol that allows users to execute various yield management strategies.

ChainCatcher message, OneKey's official X account has issued a reminder that some users have experienced login attempts on their Dexx account email. If you have logged into Dexx, remember to change your Web2 password.If you use the same password for your email and the Dexx trading platform, we recommend that you change the passwords for all associated Web2 accounts that use the same password as soon as possible.It is best to abandon this password altogether. This will prevent further breaches by Dexx insiders or hackers, especially if your email contains sensitive information and is linked to multiple account authentications.

ChainCatcher message, OneKey's official Chinese account posted on social media that DEXX may have uploaded users' clipboard content.It has received feedback that the app repeatedly requests "upload user clipboard content" permission. If users have copied private key mnemonic phrases on their phones, they may need to transfer their assets as soon as possible.

ChainCatcher news, the open-source hardware wallet OneKey announced that it will gradually discontinue the current OneKey Card service.The specific discontinuation schedule is as follows:Phase One (September 30, 2024): Users can continue to spend and withdraw normally, while the registration and recharge functions will be discontinued.Phase Two (October 31, 2024): All cards will be automatically deleted by the system, and the balance of the cards will be transferred to the OneKey Card wallet account, which can be withdrawn to an exchange account or Web3 address at any time.Phase Three (January 31, 2025): The OneKey Card service will be stopped.

ChainCatcher message, OneKey Open Source Wallet stated on platform X that due to sudden changes in bank interest rates, fees have unexpectedly increased, and this is to inform about the new changes in advance.Details of the rate adjustment: Card numbers starting from 404038, 485997, and 556150 are affected; non-US dollar or transactions outside the US are affected; the new rate adds 1% plus $0.50 per transaction. For transactions between 08:00 Beijing time on October 31 and 08:00 on November 4, OneKey will compensate for the additional fees within 2 weeks.

ChainCatcher news, according to the official OneKey hardware wallet, starting from September 31, 2023, OneKey Card will stop accepting new user applications from the following countries or regions: Iran, North Korea, Syria, Russia, North Macedonia, mainland China, Sudan, Venezuela, and Zimbabwe.Users who have already activated their cards are not affected and can continue to use them normally. It is reported that this move is to strictly comply with local laws and regulatory requirements.