OneKey Pro: custody score 94%

OneKey · Multi-asset · checked 2026-11-05. 80 of 85 points from sourced facts.

Score, input by input

Input	What we found	Points	Source
Supply chain and authenticity Genuine-device check	In the app: The OneKey app runs an anti-counterfeiting check that confirms the device is original.	10/10	source
Supply chain and authenticity Official reseller list	Being re-vetted: After CryptoBilis, OneKey stopped adding resellers, is re-vetting every one, and says it will publish the full list when done.	2/5	source
Supply chain and authenticity Tamper evidence	Seal or resistance: Holographic seal and packaging checks; OneKey says to judge authenticity by the in-app check, not the box.	3/5	source
Supply chain and authenticity Response to reseller incidents	Fast: Cut off CryptoBilis and offered free replacements for every device bought there since March 2026; no OneKey losses reported.	5/5	source
Key protection Secure element	Certified (EAL): EAL6+ secure elements (four on the Pro).	6/6	source
Key protection Open firmware	Open, reproducible: Firmware and apps on GitHub under GPL-3.0, with reproducible builds.	9/9	source
Signing safety Own screen to check what you sign	Yes: 3.5-inch touchscreen shows what you sign.	15/15	source
Customer data exposure (36 months) Customer data	None found: No customer-data breach found for the last 36 months.	15/15	none found
Incident record (24 months) Security incidents	None found: No device or vendor security incident found in the last 24 months (a 2023 physical-access flaw found by Unciphered was patched).	15/15	source

Where to buy safely

Buy from the maker: onekey.so.
Resellers: After CryptoBilis, OneKey stopped adding resellers, is re-vetting every one, and says it will publish the full list when done. source
Revoked: CryptoBilis (Ledger (sales halted Oct 9, 2026), Trezor (removed Oct 9, 2026) and OneKey (authorization ended Oct 12, 2026)). source
On arrival: check the packaging, run the genuine-device check, and reject any device that already has a PIN or recovery phrase set.

Keep it away from your bots

A hardware wallet is the vault. Don't connect it to a trading bot, an API key or an agent wallet: give the bot a separate trading float and sweep profits back to the vault's address. How to split vault, float and sweeps. Set up OneKey Pro as cold storage, step by step.

Questions

Is OneKey Pro safe?

OneKey Pro scores 94% on our custody score (80 of 85 points from sourced facts, checked 2026-11-05). Weakest point: After CryptoBilis, OneKey stopped adding resellers, is re-vetting every one, and says it will publish the full list when done.

Has OneKey had a security incident?

No device or vendor security incident found in the last 24 months (a 2023 physical-access flaw found by Unciphered was patched).

Where should I buy OneKey Pro?

From the maker's store (onekey.so). Resellers: After CryptoBilis, OneKey stopped adding resellers, is re-vetting every one, and says it will publish the full list when done. On arrival, run the genuine-device check and reject any device that already has a PIN or recovery phrase set.

Other hardware wallets, scored

BitBox02 Nova: 89%Blockstream Jade Plus: 79%Trezor Safe 5: 78%CoolWallet Pro: 72%Foundation Passport Prime: 66%Tangem Wallet: 66%Keystone 3 Pro: 54%Coldcard Q: 49%Ledger Flex: 49%

All hardware wallets, scored · Is this seller authorized? · How we score