Review for crypto hardware wallet OneKey Classic 1S

I would like to describe you my own experience of using hardware wallet OneKey Classic 1S. I will highlight pros and cons, and you will make a decision, do you need it for your crypto assets or not

Introduction to crypto wallets

What is crypto wallet? This is a place where you store your crypto assets: NFTs, tokens, crypto currencies. Different networks (Bitcoin, Litecoin, Ethereum, Tron, Solana, etc) have different addresses (public keys), each address has it’s own private key. With the help of the private key you can sign your transaction, so it will be eligible to broadcast to blockchain.

Private key has to be securely stored, because it gives access to your crypto address and all the assets and funds

We can see a problem. If I have 10 addresses, I should somehow securely store 10 private keys. Here, where wallets are coming in. Instead of creating separate addresses you can generate one seed phrase (recovery/mnemonic phrase), thanks to BIP-39, and from seed phrase create as much addresses as you want. You can image this like all your addresses are combined into one wallet.

BIP-39 address creation

According to BIP-39, seed phrase is created from the list of 2048 words.

Seed phrase is usually:

• 12 words
• 15 words
• 18 words
• 21 words
• 24 words

The most common are:

• 12 words - normal security (128 bit)
• 24 words - higher security (256 bit)

If you think that it’s easy to brute force the phrase, take a look on the numbers. A 12-word phrase has about 2¹²⁸ possibilities, it is about

340 282 366 920 938 463 463 374 607 431 768 211 456

I will skip the computation for 24 words seed phrase :)

At this point we need to decide, where to store the seed phrase.

Hot wallets, cold wallets, hardware wallets

I will start from hot wallets, because you are using it or will use one most likely.

Hot wallets

Hot wallets are the wallets, that running on an online device. So, they are connected to the internet. For example, Metamask. It can be downloaded to your phone or computer. It is very easy to use and dive into crypto world with hot wallets.

Metamask

Seed phrase will be generated for you, you will have an ability to write it somewhere. Hot wallet will help you with signing the transactions, will show you the balances, you will be able to swap and buy tokens and many more.

You just need to keep in mind, that your seed phrase will be stored encrypted on the device and will be secured only by your password to the application.

I use hot wallet on my daily basis. It’s convenient to operate with small amounts of crypto at any time from any device.

Pros:

• Very easy to use
• Fast
• Good for small amounts

Cons:

• Vulnerable to malware / phishing
• Keys exposed to internet-connected environment

At the end of the day, please, remember:

Any place, that has internet connection, is dangerous for sensitive data, such as seed phrase or private key

Cold wallets

Cold wallets are the type of wallets where the keys/seed phrases are kept offline. Mostly we are usually talking about devices (hardwallets), but according to the definition it can be even a paper with a seed phrase or private key.

Pros:

• Protection from remote (online) attacks
• Good security

Cons:

• Less convenient
• Not fast

The good thing about cold wallets is that your sensitive information is stored offline.

Hardware wallets

Hardware wallets are also cold wallets, but I decided to separate them. What is the hardware wallet? It’s a special device, that securely stores your private keys / seed phrases and signs your transactions internally offline. The keys are not exposed to the PC or browser. Usually the hardware wallets have separate apps, that helps you to operate with your crypto assets, trade the crypto currencies and control your wallets.

As an example: OneKey, Trezor, Ledger.

Popular hardware wallets

Pros:

• Strong isolation
• Good balance of security + usability
• Seed phrases are generated inside, transactions are signed offline
• Applications have bonuses and perks for users

Cons:

• Costs money
• Can be lost/damaged
• Still vulnerable to phishing if you approve malicious transactions

Hardware wallets are much more safer than hot wallets. If you want to have more security layers and keep large amounts of crypto, take a look on hardware wallets and forget about storing private keys online.

What is OneKey hardware wallet?

OneKey is the open-source hardware wallet brand, backed by YZi Labs (formerly Binance Labs) and Coinbase Ventures — $150M valuation.

OneKey Classic 1S

Here is some official information from their website:

• Built with an EAL 6+ Secure Element, the same level of chip security used in government IDs, passports, and EMV bank cards
• SignGuard blocks 1M+ scam transactions per year before you sign
• Track, send, receive, and swap across networks — fast and simple.
• Buy with debit/credit cards, bank transfers, Apple Pay, or Google Pay.
• Stake and earn passive income securely.

They have much more features, you can take a look on their website. I will describe my impressions a bit later.

OneKey security issues history

What is really interesting for me about hardware wallets is their vulnerabilities. I have made some research and here is, what I’ve found.

Most of the vulnerabilities are documented for Legacy OneKey Mini in 2023. As for now, I didn’t find that model among their catalog and there are no critical issues in security. Just for the history, take a look.

Misuse of secure components (hardwear.io, 2023)

It was a research on the legacy OneKey Mini architecture. The presentation identified a chain of architectural/design problems around the STM32F405 + Microchip ATECC608A design, including misuse of the secure component’s RNG during initialization, PIN/slot misconfiguration, use of a deprecated ATECC revision, storing a protection key in STM32 OTP, and a lack of a viable security patch plan once configuration/OTP were locked. The researchers concluded that for affected hardware, some issues were not patchable in software and that hardware upgrade was required to mitigate hardware attacks. Youtube video

Man-in-the-middle (CVE-2023–25758, 2023–02–14)

The most solidly documented, publicly assigned OneKey hardware wallet vulnerability is CVE-2023–25758, published on 2023–02–14. NVD describes it as a physical man-in-the-middle attack after device disassembly that can recover the seed phrase on OneKey Touch firmware through 4.0.0 and OneKey Mini firmware through 2.10.0.

NVD scores it CVSS 3.1 4.2 Medium, because the attack requires physical access and high attack complexity, but the practical impact is still full confidentiality loss of the wallet secret, if successfully executed. OneKey’s official response said the issue had already been patched earlier in 2023, that no users were known to be affected, and that the attack was not remotely exploitable.

Cracking and extracting the seed (Unciphered/KeyBleed, 2023)

The attacker opens the device, inserts hardware between the CPU and secure element, tricks the device into a factory-mode-like state, and captures the mnemonic as it is relayed. This is a targeted physical compromise, not a drive-by remote exploit, but it is devastating for anyone who temporarily loses possession of a legacy device. Youtube video.

So, the exploit complexity requires device disassembly, specialized equipment, and short-term physical possession.

Anti-phishing bypass report (Github, 2026)

Description: arbitrary websites can bypass phishing protection and modify wallet security settings via unprotected private API methods

The issue is detailed and non-trivial, but because there is no public advisory or explicit release-note reference in the sources reviewed, I cannot state with confidence whether it was valid as reported, silently fixed, closed as duplicate, or closed for another reason. Github issue.

Overall, legacy OneKey hardware had serious, well-documented physical-compromise weaknesses. Newer OneKey hardware and update transparency appear materially improved.

The company has improved the security of their products significantly from 2023 and has passed the security audit by SlowMist.

Audit report.

SlowMist’s overall conclusion for this audit is Low Risk.

Issues identified during the audit were primarily categorized as medium or low risk. The single medium risk issue has already been fixed. Other low risk findings and structural recommendations were reviewed and incorporated into ongoing optimization plans. No issues were classified as critical or high risk.

Impressions from using OneKey Classic 1S

Let’s start from the initial setup.

I didn’t face any issues. As for me, everything was intuitive and clear. You just turn on your device and follow the instructions. During the setup I recommend to choose seed phrase with 24 words and PIN code with at least 6 digits. Also for more security you can enable passphrase, which can be set later in the app.

After the initial setup of your hardware you need to download the application and connect your OneKey device. From now on, you can sign transactions, buy/send crypto, etc.

Let’s highlight some pros, that I like the most. Of course, before using I didn’t read the documentation and some of the features were surprised me.

Zero-fee for TRON transfers and swaps

When I was transfering my USDT, I’ve found out, that OneKey wants to pay my fees for the transfer! Technically, they have delegated me some energy for the transfer and the bandwidth was consumpted from my account. Still, this is very pleasant, especially, when you don’t make a lot transfers a day. You can save money on fees!

There are some limitations for this program:

• Each address can claim once every 24 hours, maximum 10 times per month.
• Each IP address can claim a maximum of 15 times per month.
• Your Tron address should be activated (just send some TRX on it). This is required for delegation system in Tron.

Also you will spend 0 fees for stablecoin swaps. Read more about all details on the official website.

One more thing, OneKey has Gas account, that can handle the network fees for you! Gas Account availability is checked automatically based on the network, transaction type, network fee level, and service status. It is not available for every network or every transaction.

So, if you don’t make a lot transfers every day and send USDT once in 2–5 days, most likely you will get that bonus!

Great documentation

These guys have quite detailed documentation, where you can find all the necessary information about the device, process of configuring the app, features, certificates, tests, etc.

Cute wallpapers

I think this was the most impressive thing for me, just take a look!

Custom wallpaper OneKey Classic 1S

I cannot leave you without the original. 😆

Passphrase and hidden wallets

You can add additional layer of security and add passphrase to your seed phrase.

Passphrase protects your recovery phrase. Even if someone find your phrase, it will be impossible to get your funds, because with the passphrase you are having absolutely another wallet.

Passphrase creates other wallets

You can create any number of passphrases and what I like, you can create (print) them on your hardwallet. This is more secure, than print them on your phone or laptop and then send to device.

Remember the passphrases! They are unrecoverable

Passphrases create hidden wallets. You can display them in you application or hide, so no one can see them.

Wide chains support

In the application you will find a big variety of different chains and tokens. About 100+ chains and 30000+ coins.

When someone sends you funds, you will pretty fast see it in the application. I like the response time.

Self-custody, no KYC

Your funds and assets are yours. Nothing more to say. This is not a cryptocurrency exchange. You are the owner of your wallets, passphrases and seed phrases.

If you lose your phone, destroy hardware wallet, forget the pin from the account, nothing will happen with your assets as soon as you know your recovery (seed) phrase, written on the paper or somewhere else, and your passphrase.

Only one recovery phrase on hardware wallet

It disappointed me a bit. OneKey Classic 1S can store only one recovery phrase on hardware wallet. You can create hot wallets in the application and the hardware will keep them as well, but cold wallet can be only one. You also can create passphrases to separate the wallets, but this is not the same, as having the ability to add cold wallets with their own mnemonic phrases. This is a minus for me.

App sometimes didn’t respond

I’m using Android and sometimes buttons Buy/Send didn’t work for me. They didn’t respond to any clicks. After restarting the app, the problem was solved, but it is annoying. It was not frequent, this is a minor thing, but I think it’s better to mention.

Maybe the app has been already patched and all the bugs were fixed.

Pros and cons

Let’s combine all pros and cons, that I have found when I was using the hardware wallet.

Pros:

• Zero-fee for TRON transfers and swaps
• Easy setup
• Great documentation
• Custom wallpapers
• Passphrases and hidden wallets
• Wide chains support
• Self-custody, no KYC
• EAL 6+ Secure Element and security in general
• Swaps, perps, buy/sell crypto
• App hot wallets, backups for hot wallets
• Open source

Cons:

• Only one recovery phrase in device
• App sometimes didn’t respond

Conclusion

Despite the minuses, that I have mentioned, I was satisfied with this hardware wallet. I didn’t find big issues for me. The history of the vulnerabilities is not so good, but after 2023 there were no any critical problems. The company year after year improves the performance, security, adds new features and perks. I like it. You need to understand, that I didn’t specify all the perks and abilities of the application. I just mentioned the things, that I use.

From my point of view, it’s a good choice, if you want to make a step forward from hot wallets to the security space of hardware wallets. If you are concerned about your funds, you want make transfers more safely or store your assets - better to get hardware wallet.

If you are a beginner, or you don’t make big transfers, or you don’t use crypto very often, I think you don’t need it. Just use hot wallets (Metamask) or crypto exchanges, and it will be much more than enough.

Always check your transactions before signing!

In case you decide to migrate from hot wallet to hardware wallet, do not copy-paste your private key or seed phrase. Create new phrase on your hardware wallet and move all assets to that wallet. Better not to keep large amounts on the wallets, keys of which were exposed to internet-connected environment.

For those, who decided to buy OneKey, I have 10% discount code UZZRJQ. Or you can use refferal link.