A OneKey wallet is either the free app, which keeps your keys on a phone or computer, or a hardware device, which keeps them on a secure chip. The app is genuine only from onekey.so and the stores it names. Two pages that rank for this search today are not OneKey’s, so that is where this review starts.
Listen to this article, about 13 minutes. A synthetic voice reads the article and announces each section title as it begins; tables are read row by row and the questions at the end are left out.
Recorded 20 October 2026 from the article as published that day. Press a chapter to jump there; the highlighted line is what is playing. A play button sits beside every section heading, and once you scroll past this player a bar at the bottom of the screen keeps the controls in reach. Tap or click any sentence to hear the reading start from there.
On this page: OneKey’s download page, shop, reseller list and firmware feeds read on 20 October 2026, the genuine sources in one table against the Flathub wrapper and Digital Shield, the licence text, and what about 25 owner accounts report.
Think you already know this? Five questions, one minute.
Every answer is on this page. Answer from what you know now; the page fills in the rest.
-
1. What does the Flathub OneKey listing say about its relationship to OneKey?
The Flathub listing carries an Unverified badge and says the community package is not verified by, affiliated with or supported by OneKey. OneKey’s own download page lists Linux directly. Read the section
-
2. What did OneKey say about new resellers in its statement updated on 12 October 2026?
OneKey’s response to the CryptoBilis incident says it terminated CryptoBilis, stopped onboarding new resellers and will re-vet every existing one; on 20 October 2026 its reseller page listed one. Read the section
-
3. What does the OneKey Standard Source License, version 1.1, grant?
The licence in OneKeyHQ/app-monorepo grants reproduction solely for Reference Use and excludes the right to distribute, sublicense or publicly display, so the code can be read and audited but not forked or shipped. Read the section
-
4. What did the Unciphered attack on the OneKey Mini require?
Unciphered’s write up and Fortune’s report describe a field programmable gate array placed between the processor and the secure element of a disassembled device. OneKey said it fixed the flaw in firmware. Read the section
-
5. Used without any hardware, where does the OneKey app keep your recovery words?
The App Store listing presents hardware as optional: alone, the app is a software wallet holding the words on the device it runs on; paired with a OneKey, Ledger or Trezor device, the device signs. Read the section
What is a OneKey wallet, the app or the hardware?
Both, and the word covers two different security positions. The app, listed on the App Store as OneKey: Bitcoin & Stocks by ONEKEY LIMITED, at version 6.6.1 dated 10 October, is a software wallet. Used alone, it generates and stores your recovery words on the phone or computer it runs on. The hardware is a separate purchase that moves the keys onto a device with a secure chip, and the app becomes the screen you drive it from. The listing says it also pairs with Ledger and Trezor devices.
On 20 October 2026 the OneKey shop listed five devices: the Pro 2 at $299, the Pro at $278, the Classic 1S at $99, and the Classic 1S Pure at $79, which also comes in a Bitcoin Edition at the same price, plus the SeedCard at $39 and the KeyTag at $59. The Classic, the Mini and the Touch, which older reviews still describe as the range, were not on the page. That matters later, because firmware for a device no longer sold tends to slow down, and we checked.
Which OneKey downloads are genuine and which just rank?
Search for the OneKey wallet today and the top results are the App Store listing, OneKey’s own blog twice, a Flathub page and some listings sites. No independent review, and two of the pages are not OneKey’s.
| Source | Who publishes it | Status on 20 October 2026 |
|---|---|---|
| onekey.so/download | OneKey | Official. Mac, Windows, Linux, iOS, Android and the Chrome extension, with more at app.onekey.so/market |
| App Store, developer ONEKEY LIMITED | OneKey | Official. Version 6.6.1 |
| firmware.onekey.so | OneKey | Official firmware updater, linked from the download page |
| github.com/OneKeyHQ | OneKey | Official source repositories and the vulnerability reporting route |
| Flathub so.onekey.Wallet | A community packager | Not OneKey. Unverified badge; says it is not verified by, affiliated with or supported by OneKey. Version 6.4.0, two releases behind |
| Digital Shield devices and apps | Digital Shield | Not OneKey. OneKey’s statement of 9 October 2026 says they use its firmware without authorisation |
Digital Shield is the sharper case. In a statement updated on 9 October 2026, OneKey said Digital Shield is not a OneKey product, that it never allowed the company to use, modify or distribute its software or firmware, and that it cannot verify how those devices are built or signed. It adds that search results, including AI generated summaries, had called Digital Shield a rebranded or localised OneKey. The Flathub package is honest about what it is, which is more than that; it is still a wallet built by someone other than the vendor.
OneKey’s phishing guide puts the habit plainly: check that the root domain is exactly right, because attackers buy search adverts and change a single character. The root is onekey.so. Nothing in this article asks you to type a recovery phrase anywhere, and no genuine OneKey page will either.
Is this link or seller genuine OneKey?
Compare whatever you were sent against this list, read from OneKey’s own pages on 20 October 2026. It checks sources, not wallets, and it never asks for anything of yours.
Ticks are saved on this device only. A source not on this list is not genuine until OneKey’s own pages say otherwise.
Where do you buy a genuine OneKey device after the CryptoBilis case?
From the shop above, or from a reseller still on OneKey’s list, and that list shrank this month. On 9 October 2026 Ledger began investigating devices sold by its reseller CryptoBilis, which had sold several brands; our Ledger comparison covers the implant itself. OneKey’s part is a statement updated on 12 October 2026, OneKey’s Response to the CryptoBilis Incident. It terminated CryptoBilis’s authorisation, stopped onboarding new resellers “effective immediately”, and said every existing reseller will be vetted again, with any whose business entity or beneficial owner cannot be verified removed from its website.
It also said: “We have no reports of OneKey users losing assets in this incident, but we are acting as if the risk is real.” Anyone who bought a OneKey device from CryptoBilis between 1 March 2026 and the statement date can apply for a free replacement through the support button on onekey.so until 31 December 2026, with proof of purchase. For a device already in use, the advice is to treat the current recovery phrase as possibly compromised, move funds to a freshly generated phrase, and never import the old phrase into the new device. OneKey support will never ask for a recovery phrase or PIN.
Here is the dated check the ranking pages do not carry. On 20 October 2026 the OneKey Reseller Network page, marked “Updated this week”, listed exactly one reseller: Pro Hash in Brazil. The statement promised a complete list once the review finishes, so the page may grow again. Until it does, a seller not on it is not authorised, whatever its product page says.
Whatever the source, the device itself can be checked. OneKey’s anti counterfeiting page, dated 15 December 2025, describes a Device authentication option in the app that verifies the serial number with OneKey and shows “Verification successful” on the device screen, and says the check “does not interact with the secure chip, so your recovery phrase is safe”. A second option verifies that the installed firmware matches OneKey’s published release. Neither proves a device was never opened, which is the lesson of the Ledger case, so both sit alongside buying from the right place rather than replacing it.
Is OneKey actually open source?
Partly, and the licence is not what the word usually means. The app’s code is public at OneKeyHQ/app-monorepo, with 2,471 stars and a commit pushed on 20 October 2026, under the OneKey Standard Source License, version 1.1, effective February 2025. The text grants the right “to reproduce the Software solely for Reference Use”, defined as read only use within your company, and “excludes the right to distribute, sublicense, publicly display”. Derivative works are reserved to OneKey. You can read it and audit it. You cannot fork it, ship it or build on it. That is source available, and our open source wallet guide explains why the difference matters for reproducible builds.
The firmware is split. OneKey’s firmware audit page, dated 6 August 2026, says the main control firmware and the Bluetooth firmware are “maintained in an open-source manner” and can be checked against GitHub release tags, while the secure element firmware “has completed security auditing” but is not public because it involves the chip maker’s intellectual property. The page names SlowMist as the auditor of the Pro’s main firmware at version 4.10.0, fixed in 4.11.0, and of the Classic 1S, with no audit dates and one report link still a placeholder. OneKey’s blog post announcing the audit is dated 26 January 2026.
| Device line | Latest firmware release | Published | Repository |
|---|---|---|---|
| Pro | v4.21.0, also a BTC only build | 3 July 2026 | firmware-pro |
| Classic (classic tags) | classic/v3.12.0 | 6 May 2026 | firmware |
| Touch | touch/v4.12.0 | 6 May 2026 | firmware |
| Mini | mini/v3.10.0 | 20 May 2025 | firmware |
Dates were read from the GitHub release feeds on 20 October 2026. The Classic 1S has its own repository, firmware-classic1s, pushed the same day, whose releases we did not read. The Mini has had no release for seventeen months and is no longer in the shop. A Mini owner is not in danger because of that table. They are running a device whose last fix predates the SlowMist audit, and that is worth knowing.
What did the 2023 OneKey Mini hack change?
It made OneKey encrypt the conversation between its two chips. In February 2023 the recovery firm Unciphered published a video in which a OneKey Mini gave up its seed in under a second. The method, as Fortune reported, placed a field programmable gate array between the processor and the secure element, where traffic was not encrypted, and made the device behave as if it were still in the factory. It needed the device in hand, opened, with the interception hardware attached.
OneKey acknowledged the flaw, said it had been fixed in firmware, and paid Unciphered a bounty. No user losses were reported. The part that was attacked, the link to the secure element, is the part whose firmware is still not public. Audited, says the page. Not checkable, says the page.
What do OneKey owners actually report?
We read about 25 accounts across three platforms, dated June 2024 to October 2026: eight Trustpilot reviews from a page scoring 4.1 from 262 reviews with 21 percent at one star, three App Store reviews from a 4.7 rating on 681 ratings, and three r/OneKeyHQ threads with their replies. These are what people report, not findings, and none is proof of a device fault.
The pattern is consistent and a little unflattering to the software. A June 2024 App Store review gave two stars for a device the reviewer preferred to its rivals, paired with an app that missed chains and showed stale balances. A July 2025 review praised the Pro’s touchscreen and asked for a better organised app. A Trustpilot reviewer in January 2026 reported timeout errors on a Pro when receiving and email only support. In a February 2026 r/OneKeyHQ thread, one reply described the same timeouts and once a day support replies, OneKey’s account answered with its live chat and email, and an April 2026 reply said the Pro did not support Ledger’s legacy Ethereum derivation paths.
The cuts against it are real. Three Trustpilot reviews in September 2026 praised support for solving problems. The most useful Bitcoin account was an August 2026 thread from a Classic 1S Bitcoin Edition owner building a Sparrow multisig who did not want to type a passphrase on the computer. A reply suggested binding the passphrase to a PIN on the device; the poster tested it and reported that Sparrow no longer asked for the passphrase. That is one owner’s report, not vendor documentation, and the trade offs of a passphrase at all are in our passphrase guide.
On 17 October 2026 an r/OneKeyHQ thread asked why OneKey was silent on the reseller hack while promoting the Pro 2. Replies pointed to the blog statement and posts on X, one commenter said they had switched from Ledger over the supply chain case, and the poster conceded the response was good but wanted it where owners could ask questions. Where the accounts agree with the documentation: the device verifies, the statement exists. Where they go further: owners wanted it said to them, not just published.
What does the app do with your keys, and what is OneKey Earn?
Used as a software wallet, the app holds the recovery words on the device it runs on, which our cold wallet explainer calls the least isolated end of the spectrum. Used with a OneKey, Ledger or Trezor device, it builds transactions and the device signs them, with the listing describing “offline signing and secure communication”.
The listing also advertises OneKey Earn, described as “Yield opportunities through trusted DeFi protocols” with “real-time monitoring and risk alerts”. This site describes that feature as present and recommends none of it. Yield is a financial decision outside what this article covers. The app’s store name now ends in Stocks, a change we did not test. Neither feature moves your Bitcoin keys, and where they live is the only question a custody review can answer. For another vendor’s device on the same questions, see the Trezor hardware wallet review.
Frequently asked questions
Is the OneKey wallet app free?
Yes. The app is a free download from onekey.so and the App Store, where the developer is ONEKEY LIMITED. The hardware is the paid part, from $79 for the Classic 1S Pure to $299 for the Pro 2 on 20 October 2026.
Is the Flathub OneKey package safe to use?
It is a community package, not OneKey’s. Flathub marks it Unverified and the listing says it is not affiliated with or supported by OneKey. OneKey’s own download page offers Linux directly.
Is Digital Shield the same as OneKey?
No. OneKey’s statement of 9 October 2026 says Digital Shield is not a OneKey product, uses its firmware without authorisation, and gets no security guarantee, update or support.
Did OneKey devices get the CryptoBilis implant?
OneKey said on 12 October 2026 that it had no reports of its users losing assets, but it terminated the reseller, paused new resellers and offers free replacements for purchases from 1 March 2026 until 31 December 2026.
Which OneKey firmware is current?
On 20 October 2026 the GitHub releases showed Pro v4.21.0 from 3 July 2026, Classic v3.12.0 and Touch v4.12.0 from 6 May 2026, and Mini v3.10.0 from 20 May 2025. Update through the app or firmware.onekey.so only.
Does OneKey ever need my recovery phrase?
No. OneKey’s statements say support will never ask for a recovery phrase or PIN, and its device authentication check does not touch the secure chip. Any page or message asking for the phrase is not OneKey.
Finished the page? The same five questions from the top, to see what stuck.
General information about wallet security, not financial advice. Theo Brandt holds no financial qualification and nothing here is a recommendation to buy, sell or hold any asset, or to use any yield, lending, staking or leverage product. Claims were verified on 20 October 2026 against the sources linked above. For your own situation, speak to a qualified professional.
Leave a Reply