We pull OneKey apart before it ships.
Anzen Lab is OneKey's in-house security team. We work on the hardware, the firmware, and the apps before they ship, coordinate disclosure with outside researchers, and publish the tools and write-ups behind the work.
Five things we work on. The job stays the same: your keys never leave the device.
We focus on where self-custody users actually get hurt: the silicon, the firmware, the companion app, and the open-source supply chain the whole stack rides on.
Hardware
Hardware security analysis
Side-channel, glitching, fault injection, and physical-attack work on OneKey devices and competing wallets. We try to break our own stuff first.
Firmware
Firmware & secure-boot research
Reverse engineering, signature-verification audits, secure-boot integrity reviews, and update-flow validation across every device family we ship.
App & Web
Internal pentest & red team
Continuous testing of the companion app, the in-app browser, the inpage provider, and the backend. The team shipping the code is the team breaking it.
Supply chain
Threat & supply-chain intelligence
We monitor what the wallet stack pulls in: npm registries, build tooling, AI coding agents. When something breaks upstream, we patch fast.
Disclosure
Coordinated disclosure
Public bug-bounty on Bugrap, a security inbox at [email protected], a PGP key. We credit external researchers and publish what we find.
Adjacent
Where we contribute
Secure development practices, internal security training, smart-contract review, and open-sourcing the tools that came out of our day-to-day work.
OneKey hardware wallets — the security boundary.
This document describes the threat model for OneKey hardware wallets: the security goals the device intends to achieve, the attackers and threats it must address, and the trust assumptions on which the model rests.
Key confidentiality
Seed phrases, private keys, and their derivation capabilities are generated and used only inside the device. They are unreadable to all external components.
Signing-content integrity
The critical fields shown on the device screen (amount, address, chain ID, contract method, allowance) must be semantically consistent with the transaction or message the device finally submits for signing.
Firmware authenticity
The boot chain, main firmware, BLE firmware, and release artefacts maintain an identifiable origin. Any substitution, mismatch, or rollback should be detectable by the device or by the user, and the firmware-to-source consistency can be independently verified.
Key protection on loss of physical control
After the device is lost or stolen, PIN brute-force, state rollback, or misuse of interfaces should not be able to reliably recover the keys or produce unauthorised signatures.
How we analyse.
Four lines we're working on right now: hardware fault injection, side-channel analysis, firmware fuzzing, and AI-assisted code review. Bench photos and longer write-ups will follow as the lab build-out wraps.
Hardware
Fault injection
Voltage and electromagnetic glitching, laser fault injection, and clock manipulation against our own devices and competing wallets. We document the rig setup, the targets, and the findings as the bench comes online.
Hardware
Side-channel analysis
Power-trace capture, electromagnetic emission analysis, and timing-side-channel measurement against signing operations and PIN entry. Applied both to our own hardware and to competitive teardown reviews.
Firmware
Firmware fuzzing
Boundary fuzzing of bootloader update paths, USB and BLE protocol stacks, and on-device transaction parsers (PSBT, EIP-712, contract calls). Reproducible harnesses across every device family we ship.
AI + code
Automated AI audit
Every pre-release diff gets reviewed by a frontier model alongside the human reviewers. Running multiple models in parallel reduces blind spots from any one auditor. Anything either side finds enters the same triage queue.
Bring us a real bug. We pay and credit you.
OneKey runs a public, paid bounty on Bugrap covering hardware, firmware, the companion app, and the backend. Scope, severity matrix, reward tiers, and reporting standards live on Bugrap. That page is the source of truth; this one isn't.
We attack our own product first.
Anzen Lab is a small in-house team — hardware, firmware, and application security engineers — working with a rotating set of external researchers and audit partners.
Our charter is narrow on purpose: make OneKey products safer. When the work is useful to the wider self-custody and open-source community, we publish it under the same name — tools, methodology, post-mortems.
"Anzen" (安全) is the word we use internally for what we're trying to protect. It's the only thing this team is measured on.
How we work with researchers.
Every credible report gets a human reply from a security engineer. We coordinate fix timelines, credit the reporter on the bulletin (anonymously on request), and pay through the bounty program rather than negotiating case-by-case.
How we work with audit partners.
We send pre-release commits to external auditors before every major device or app release, and we publish the resulting reports once findings are remediated.
We're hiring.
Hardware analysis, firmware reverse engineering, internal pentest, red team. If you've broken a wallet before — ours or anyone else's — we want to talk.