OneKey Has Passed a Security Audit by SlowMist

The security of a hardware wallet ultimately depends on how it is engineered, not on abstract claims.

OneKey has completed a security audit conducted by the third party security team SlowMist. This audit reviewed the device firmware and key security mechanisms, and a formal audit report has been issued. The full report is available at the end of this article.

Why Third Party Security Audits Matter

For a hardware wallet, security goes beyond whether private keys are kept offline. The firmware upgrade path, how the device communicates with external environments, whether signing data can be altered during the signing process, and whether what users see on the device truly reflects what is being signed all define the real security boundary.

These aspects are difficult to fully validate through internal testing alone. A third party security audit introduces a perspective closer to real world attack scenarios and helps examine whether the overall system design exposes overlooked weaknesses.

Scope and Focus of This Audit

According to SlowMist, this audit focused on OneKey firmware and device level security design. The review covered firmware upgrade and integrity mechanisms, private key related processes, device communication security, and the consistency between signing data and user interaction.

The audited code versions, firmware files, and released binaries are verifiable against each other, ensuring that the audit conclusions correspond to the versions delivered to users.

Audit Conclusion Overview

SlowMist’s overall conclusion for this audit is Low Risk.

Issues identified during the audit were primarily categorized as medium or low risk. The single medium risk issue has already been fixed. Other low risk findings and structural recommendations were reviewed and incorporated into ongoing optimization plans. No issues were classified as critical or high risk.

Notes on Fixed and Acknowledged Issues

During the audit, SlowMist proposed improvements related to firmware upgrade paths and device communication processes. In response to the risk of firmware rollback to older versions, OneKey has implemented restrictions to prevent downgrading to firmware versions with known issues.

Bluetooth related workflows were also adjusted so that pairing requires the device to be unlocked, reducing the risk of unauthorized connections.

Other low risk findings and suggestion level items mainly involve communication strategies, application authentication, and long term hardware security design. These do not form directly exploitable attack paths, but they remain relevant for strengthening the overall security model. OneKey has evaluated these findings internally and continues to improve accordingly.

Security Audits Are One Step in an Ongoing Process

It is important to note that a security audit is not an endpoint.

For OneKey, the value of third party audits lies in validating whether the current security design has clear boundaries and whether any assumptions require further scrutiny. As firmware and usage scenarios evolve, security mechanisms must be continuously reviewed and updated.

Going forward, OneKey will continue working with external security teams and revisiting core security assumptions on a regular basis. All security conclusions are grounded in verifiable implementation.

SlowMist Audit Report - OneKey Pro_en-us.pdf
SlowMist Audit Report - OneKey Classic 1s_en-us.pdf
SlowMist Audit Report - OneKey SDK_en-us.pdf