All Wallets Compared
Detailed review

OneKey review: the fully open-source hardware wallet with four secure chips

Research-based review by Sharif Ahmad · How we test

Independent publication≈ 10 min read

OneKey's main pitch is transparency: its firmware and app are open source and independently verifiable. The flagship Pro adds four EAL6+ secure elements, a touchscreen and a published SlowMist security audit. This review also examines the well-documented 2023 vulnerability that affected the discontinued OneKey Mini.

Visit OneKey.com → Referral code: 15FYN3

Referral link — we may earn a commission at no extra cost to you. Our reviews stay editorially independent of commissions.

Disclosure: ColdCompare is an independent blog and is NOT affiliated with, endorsed by or operated by OneKey. All trademarks remain the property of their respective owners. Some links may be referral links — details below every button.

the OneKey Pro — a 3.5-inch touchscreen hardware wallet with four secure elements.
The OneKey Pro — a 3.5-inch touchscreen hardware wallet with four secure elements.
01Post 01

Our concise assessment

OneKey is one of the few hardware-wallet brands that combines fully open-source software with dedicated secure elements. The Pro's four-chip design and SignGuard scam detection are genuine strengths. OneKey is, however, a smaller and younger brand than Ledger or Trezor, and its publicly documented 2023 Mini vulnerability remains relevant context even though it affected a discontinued model and was patched.

Where it stands out

  • Fully open-source firmware and app that can be independently reviewed.
  • OneKey Pro uses four separate EAL6+ certified secure elements, not just one
  • SlowMist-audited hardware and firmware, with a published audit report
  • SignGuard clear-signing layer flags risky transactions/scam contracts before you approve
  • Broad multi-chain support with a built-in DApp browser, swap and staking dashboard
  • Touchscreen, fingerprint unlock and wireless charging on the Pro, with a broad feature set for its price.

Trade-offs to keep in mind

  • The built-in battery in battery-equipped models is not user-replaceable, which raises a long-term durability question.
  • Open-source firmware does not remove smart-contract or dApp risk; transaction approval still requires care.
  • The 2023 OneKey Mini 'hacked in one second' incident is a reputational overhang, even though patched and on a legacy model
  • Smaller brand recognition and shorter independent-scrutiny track record than Ledger or Trezor
  • Exact chain and asset compatibility can change over time; verify the specific network you need before buying
  • OneKey announced its Series B on April 7, 2026 at a $150 million valuation, led by YZi Labs.
OneKey's proposition is straightforward: open-source software with hardware-level protection. The Pro largely delivers on that idea, but the brand still has a shorter public track record than Trezor or Ledger.
02THE BASICS

What exactly is OneKey?

OneKey's core differentiator is that both its firmware and companion app are open source and published on GitHub. The current lineup includes the flagship OneKey Pro with a 3.5-inch touchscreen, fingerprint unlock, Bluetooth, Qi2 wireless charging and QR signing, plus the slimmer Classic 1S and battery-free Classic 1S Pure.

OneKey announced its Series B on April 7, 2026 at a $150 million valuation, led by YZi Labs (formerly Binance Labs).

03SECURITY

Security & protection model: four chips, open firmware, and one honest incident

The Classic 1S uses a single EAL6+ certified secure element, while the OneKey Pro uses four EAL6+ secure elements. OneKey also publishes firmware and app source code and provides a firmware-verification guide.

Backup uses a standard 12/24-word BIP39 recovery phrase with optional passphrase support. OneKey commissioned a public security audit from SlowMist.

In February 2023, Unciphered demonstrated a physical attack against the older OneKey Mini that exploited communication between its CPU and secure element. The attack required physical disassembly and specialist equipment; OneKey said the issue had already been fixed before public disclosure. The Mini is a legacy model with a different architecture from the current Pro and Classic 1S range, but the incident remains relevant historical context.

[EAL6+]

Multiple certified chips

One EAL6+ chip on Classic 1S; four separate EAL6+ chips on the Pro.

[OSS]

Fully open source

Firmware and app code are published on GitHub, with a public verification guide.

[SM]

SlowMist audited

Independent security audit with a publicly published report.

[SG]

SignGuard

A real-time transaction/scam-contract detection layer before you approve a signature.

[PASS]

Passphrase / hidden wallets

Optional BIP-39 passphrase support for plausible-deniability hidden wallets.

[2023]

OneKey Mini incident (patched, legacy)

Worth knowing: a 2023 physical-attack flaw on the older Mini model, fixed before disclosure.

04PRICING

Price & costs & product line

OneKey spans a genuine budget-to-flagship range, from a battery-free card wallet to a full touchscreen device with four secure elements.

Classic 1S Pure
$79
Battery-free, tethered
1× EAL6+ chip
no onboard battery, so it stays plugged into your phone or PC while in use; the budget entry point.
Classic 1S
$99
Built-in battery
1× EAL6+ chip
same slim card form factor as the Pure edition, plus an onboard battery for standalone use.
Most popular
OneKey Pro
$278
3.5" touchscreen
4× EAL6+ chips
the flagship: color touchscreen, fingerprint unlock, wireless charging and four separate secure elements.

Prices re-checked on onekey.so on September 11, 2026; promos and bundles rotate. Verify current pricing before buying.

OneKey's touchscreen Pro model alongside the slimmer Classic 1S card wallet.
OneKey's touchscreen Pro model alongside the slimmer Classic 1S card wallet.
05THE APP

The app: supported assets & features

The OneKey App is available on desktop, mobile and as a browser extension. OneKey currently advertises 30,000+ supported coins across 100+ chains on the Pro product page. Exact compatibility can change, so verify the specific chain or asset you need before buying.

A real-time scam/risk-detection layer that shows a clear-signing preview before you approve a transaction, aimed squarely at the phishing-approval attacks that plague every self-custody wallet regardless of hardware security; app features include in-app swap (aggregator-based routing), a DApp browser, a one-stop staking dashboard, NFT display, and the standout SignGuard feature.

[COIN]

30,000+ assets claimed

100+ chains advertised by OneKey; verify the exact network you need before buying.

[DESK]

Native desktop app

The only wallet reviewed here with a full desktop client, alongside mobile and browser extension.

[SG]

SignGuard scam detection

Real-time preview and risk flagging before you approve a signature.

[STK]

Staking dashboard

One-stop staking management across supported networks.

[DAPP]

DApp browser

Direct DeFi access, plus WalletConnect v2 for third-party dApps.

[NFT]

NFT support

View and manage NFTs directly inside the OneKey app.

06HEAD TO HEAD

OneKey vs. Ledger vs. Trezor

Vs. Ledger: OneKey emphasizes open-source firmware and app code, while Ledger's secure-element firmware remains closed source. Ledger has a longer market track record and broader ecosystem integration; OneKey Pro differentiates itself with four EAL6+ secure elements and a transparency-first positioning.

Vs. Trezor: both brands emphasize open-source transparency. Trezor's current Safe 3/5/7 lineup also uses certified secure elements, while OneKey Pro differentiates itself with multiple secure elements, fingerprint unlock and Qi2 charging.

07HONEST TAKE

Honest criticism: what open source doesn't solve

Open firmware isn't a magic shield. SignGuard can flag suspicious transactions, but the user still has to judge what is being approved. Hardware transparency cannot guarantee that a smart contract or recipient is trustworthy.

The battery isn't user-replaceable. On the Classic 1S and Pro, that is a legitimate long-term durability consideration for hardware intended to last for years.

The 2023 OneKey Mini incident belongs in the record. It affected an older, discontinued model and OneKey said it had already been fixed, but it remains relevant context when evaluating broad security marketing claims.

Compatibility changes over time. OneKey currently advertises 30,000+ coins across 100+ chains, but verify the live compatibility list for the exact network and asset you need.

Smaller track record. OneKey is meaningfully younger than Ledger or Trezor, meaning fewer years of adversarial public security research to draw confidence from, even with the SlowMist audit in hand.

08GET STARTED

Getting set up in six steps (≈ 10 minutes)

Buy from onekey.so or an authorized reseller

Never a pre-configured device from a marketplace listing.

Power on and choose 'Create new wallet'

On-device, not through the app, unless you're restoring an existing seed.

Set a PIN

4–50 digits supported — longer is stronger.

Write down the recovery phrase

12 or 24 words on the included physical cards, confirmed word-by-word on-screen. Physical only, never digital.

Enable fingerprint / passphrase (Pro)

Optional but recommended on the Pro; a BIP-39 passphrase can create a hidden wallet.

Verify firmware and pair

Use OneKey's open-source verification process before first use, then connect via USB-C, Bluetooth or QR/air-gap.

09FAQ

Frequently asked questions

What does 'fully open source' actually mean here?

Both the device firmware and the companion app's source code are published publicly (on GitHub), and OneKey provides a guide for independently verifying that the firmware installed on your device matches that public source — something Ledger's closed secure-element firmware doesn't allow.

Is the OneKey Pro's 4-chip design actually more secure?

Splitting key material across four separate EAL6+ certified secure elements reduces reliance on a single hardware component, although it does not address user-side risks such as phishing or social engineering.

Was OneKey hacked?

The one well-documented incident is the February 2023 Unciphered disclosure on the older OneKey Mini, cracked in about a second via a physical attack. OneKey says it was already patched before disclosure, on a model that's now largely discontinued and architecturally different from current Pro/Classic 1S hardware.

Classic 1S, 1S Pure, or Pro — which should I get?

1S Pure if budget matters most and you don't mind staying tethered to a device while using it; Classic 1S for the same form factor with a built-in battery; the Pro if you want a touchscreen, fingerprint unlock, wireless charging and the strongest hardware security (4 chips) on offer.

Does OneKey have a desktop app?

Yes — uniquely among the wallets covered on this site, OneKey offers a native desktop app in addition to mobile and browser extension.

Understanding SignGuard?

A real-time feature that inspects a pending transaction or contract approval and flags likely scams or excessive permissions before you sign — aimed at the phishing-approval attacks that no amount of hardware security alone can prevent.

Please read

Important risk information

  • Self-custody risk: with a hardware wallet, YOU are responsible for your recovery phrase. Lose it (and the device) and funds are permanently, irrecoverably lost — there is no support line that can restore them.
  • Crypto risk: crypto assets involve risk up to total loss. Always do your own research BEFORE buying any hardware wallet or moving funds onto it.
  • Buy only from the official site or an authorized reseller. A hardware wallet bought second-hand, from a marketplace listing, or pre-configured by a seller should be treated as compromised.
  • Never enter your recovery phrase into a website, app, or anyone claiming to be support staff. No legitimate wallet maker will ever ask for it.
  • Physical-possession attacks are real: several wallets, including some covered on this site, have had documented physical tampering or fault-injection flaws (details in each review). No device is unhackable given enough time, money and access to it.
  • Verify current details on the manufacturer's own site before purchasing; firmware/app updates, pricing, specs and supported assets change over time.
  • This is not financial advice: this blog is an independent editorial publication for information purposes only and is not affiliated with any wallet manufacturer, including OneKey.

Get a OneKey

Never second-hand or pre-configured; the button opens the official store. Always buy directly from the manufacturer or an authorized reseller.

Visit OneKey.com → Referral code: 15FYN3

Referral link — we may earn a commission at no extra cost to you. Our reviews stay editorially independent of commissions.