Security Special Issue 04 | OKX Web3 & OneKey: Adding a "Buff" to Device Security
TechFlow Selected TechFlow Selected
Security Special Issue 04 | OKX Web3 & OneKey: Adding a "Buff" to Device Security
Inviting OneKey's security team, a leading encrypted hardware wallet provider, and OKX Web3 Wallet's security team to guide you with practical tips on boosting your device security with an extra "Buff".
Navigating Web3 tides with focused insightsIntroduction
OKX Web3 Wallet has specially launched the "Security Special" column, providing dedicated solutions for different types of on-chain security issues. Through real-life cases happening around users and in collaboration with experts or institutions from the security field, this series offers dual perspectives to share and resolve concerns, gradually organizing and summarizing secure transaction rules. The goal is not only to strengthen user security education but also to help users learn how to protect their private keys and wallet assets starting from themselves.
When surfing the Web3 world, there are two expenses you should never skimp on:
One is paying gas fees on-chain; the other is buying protective gear off-chain.
But whether on-chain or off-chain, security matters just as much.
This is Security Special Issue 04, featuring the OneKey hardware wallet security team and the OKX Web3 Wallet security team, who will guide you through practical tips to add a security "Buff" to your devices.
OneKey Security Team: Founded in 2019, OneKey is an open-source company focused on secure hardware and software wallets, equipped with a security research and defense lab. It has received support from top-tier institutions such as Coinbase, Ribbit Capital, and Dragonfly. Currently, OneKey hardware wallets are becoming one of Asia's best-selling brands in this category.
OKX Web3 Wallet Security Team: Hello everyone, we're excited to join this discussion. The OKX Web3 Wallet Security Team focuses on building comprehensive security capabilities within OKX’s Web3 ecosystem—such as wallet protection, smart contract audits, and monitoring on-chain project safety—to provide users with multi-layered safeguards covering product, fund, and transaction security, contributing to the overall blockchain security landscape.
Q1: Could you share some real-world device risk cases experienced by users?
OneKey Security Team: Device risks faced by Web3 users vary widely. Here are several common examples.
Case 1: After user Alice left her device unattended, someone nearby physically accessed it without her knowledge and stole her assets. In computer security, this is often called an "Evil Maid Attack," one of the most frequent types of physical device threats users face.
From colleagues at a crypto-grinding studio, housekeeping staff, to even close partners, anyone could become opportunistic attackers when money is involved. We once assisted a user investigating stolen funds from a hardware wallet. After reporting the theft and requesting KYC data from exchanges, they discovered the attacker was someone close to them—truly, “you can guard against outsiders, but not thieves within.”
Case 2: User Bob was physically coerced into handing over his asset-controlling device—an incident humorously known in the crypto community as the “$5 Wrench Attack.”
In recent years, as cryptocurrency wealth gains wider attention, kidnapping and ransom targeting high-net-worth individuals have intensified, especially in countries with higher crime rates. Early in 2023, media reported a robbery during an offline crypto meetup where victims were held captive inside a car after dinner. Criminals forced facial recognition unlock on phones and wallet apps, converting all cryptocurrencies into 4.1 million USDT before transferring and fleeing. Recently on Twitter, a veteran in the mining industry shared that he was robbed by an international criminal gang and lost most of his life’s accumulated digital assets.
OKX Web3 Wallet Security Team: This topic is highly relevant. Previously, we’ve discussed private key safety, MEME trading security, grinding risks, and other on-chain topics. But device security is equally critical. Let’s look at some classic cases.
Case 1: Tampered Hardware Wallets
User A bought a hardware wallet from an unauthorized platform and started using it without verification. The firmware had been tampered with and pre-generated multiple sets of recovery phrases. Ultimately, the hacker gained full control of the user's encrypted assets stored on the device, resulting in severe losses.
Prevention measures: 1) Purchase hardware wallets only from official or trusted sources. 2) Complete the manufacturer’s full verification process before use to ensure firmware integrity.
Case 2: Phishing Attacks
User B received an email claiming to be from a “Wallet Security Center,” stating there was a security issue requiring input of the wallet recovery phrase for an update. In reality, this was a carefully crafted phishing attack, leading to total loss of assets.
Prevention measures: 1) Never enter your private key or recovery phrase on any unverified website. 2) Use your hardware wallet screen to verify all transactions and operations.
Case 3: Software Security
User C downloaded malicious software from an unverified source. During wallet operations, due to hidden malicious logic in the software, their assets were compromised.
Prevention measures: 1) Download software exclusively from official channels and keep software/firmware updated. 2) Use antivirus programs and firewalls to protect your devices.
Q2: Common physical devices, infrastructure, and associated risk types used by users
OneKey Security Team: Devices related to user asset security typically include smartphones, computers, hardware wallets, USB storage drives, and network communication equipment (e.g., Wi-Fi routers).
Beyond the previously mentioned “Evil Maid Attack” and violent “$5 Wrench Attack,” here are additional aspects worth noting.
1. Social Engineering & Phishing Attacks
Social engineering and phishing remain widespread and effective tactics, exploiting human psychology to trick users into risky actions. For example, malicious links or attachments may arrive via emails, SMS, or social media messages disguised as legitimate notifications (e.g., bank alerts or platform updates). Once clicked or downloaded, malware infects the device, enabling remote access.
Another example: impersonating technical support. Attackers pose as customer service agents contacting users via phone or email, claiming urgent device issues requiring immediate action. They might request remote access or sensitive information disclosure. Nowadays, mentioning crypto-related terms on Twitter quickly attracts bot armies pretending to offer “support.”
2. Supply Chain Attacks
Supply chain attacks occur when adversaries implant malicious components during manufacturing or shipping. Three main forms exist:
First, hardware tampering: attackers embed malware during production of hardware wallets or USB drives. Buying from unreliable sources increases chances of receiving pre-compromised devices capable of stealing data or allowing remote access.
Second, software tampering: attackers compromise software/firmware update packages. When users install these, backdoors or other malicious code get embedded.
Third, logistics attacks: intercepting and altering devices during transit. For instance, hardware units might be swapped or modified en route, enabling future exploitation.
3. Man-in-the-Middle (MITM) Attacks
A MITM attack occurs when an attacker intercepts and alters communication between two parties.
For example, using unencrypted networks allows attackers to easily capture and modify transmitted data. On HTTP websites (non-HTTPS), attackers can alter both incoming and outgoing user data.
Public Wi-Fi poses similar risks—attackers can monitor or steal login credentials and financial records. Even home Wi-Fi can be breached under extreme circumstances.
4. Third-party Internal Threats & Software Vulnerabilities
Internal threats and software flaws represent uncontrollable yet impactful risks to device security.
The most common issue is software/hardware vulnerabilities. These can be exploited for remote or side-channel attacks. Some plugins or apps may contain undiscovered bugs, granting attackers system control. Regular updates usually mitigate this. Also, use devices with modern cryptographic chips.
Internal personnel misconduct: developers or service providers’ insiders may abuse privileges to steal user data or inject malicious code—sometimes driven by external pressures.
For instance, a “grinding studio” recently suffered asset theft after using a multi-instance fingerprint browser, likely due to internal malice in the software or plugin. This shows even legitimate tools can endanger users if internal controls are weak.
Another case: Ledger faced panic when its widely-used Connect Kit was compromised—a former employee fell victim to phishing, allowing attackers to insert malicious code into the GitHub repository. Fortunately, Ledger’s security team deployed a fix within 40 minutes, and Tether froze the attacker’s USDT holdings promptly.
OKX Web3 Wallet Security Team: Below, we summarize commonly used physical devices and their potential risks.
Common user devices include: 1) Computers (desktops/laptops) for accessing dApps, managing wallets, and participating in blockchain networks. 2) Smartphones/tablets for mobile dApp access, wallet management, and transactions. 3) Hardware wallets (e.g., Ledger, Trezor)—dedicated devices storing private keys securely offline. 4) Network infrastructure (routers, switches, firewalls) ensuring stable and secure connectivity. 5) Node devices—running blockchain nodes (on personal computers or dedicated servers) to participate in consensus and validation. 6) Cold storage—offline devices like USB drives or paper wallets protecting keys from online attacks.
Potential risks associated with physical devices include:
1) Physical Device Risks
• Loss or damage: Losing or damaging hardware wallets or computers could result in permanent loss of private keys and inaccessible assets.
• Physical intrusion: Unauthorized individuals gaining direct physical access can extract private keys or sensitive data.
2) Cybersecurity Risks
• Malware and viruses: Infect devices to steal keys or confidential data.
• Phishing attacks: Impersonate legitimate services to trick users into revealing private keys or login details.
• Man-in-the-Middle (MITM): Intercept and manipulate communications between users and blockchain networks.
3) User Behavior Risks
• Social engineering: Manipulate users into disclosing private keys or sensitive information.
• Operational errors: Mistakes during transactions or asset management may lead to irreversible losses.
4) Technical Risks
• Software vulnerabilities: Exploitable bugs in dApps, wallets, or protocols.
• Smart contract flaws: Code vulnerabilities may allow fund theft.
5) Regulatory and Legal Risks
• Compliance: Differing regulations across jurisdictions affect asset security and trading freedom.
• Policy changes: Sudden regulatory shifts could freeze assets or restrict trading.
Q3: Is a hardware wallet mandatory for private key security? What are the types of private key protection measures?
OneKey Security Team: While hardware wallets aren't the only option for private key security, they are among the most effective methods available. Their biggest advantage lies in isolating private keys—from generation and recording to daily storage—completely from the internet. Every transaction requires explicit confirmation directly on the physical device, effectively blocking risks of theft by malware or hackers.
Let’s review the advantages of hardware wallets:
1) Physical isolation: Private keys are stored in a dedicated offline device, fully separated from internet-connected computers and phones. Even if your PC or smartphone is infected, the keys remain safe since they never touch the web.
2) Transaction verification: All transactions must be manually confirmed on the device itself. Even if attackers obtain your online account info, they cannot move assets without physical approval.
3) Secure chip: Many hardware wallets use specialized secure chips (e.g., CC EAL6+ certified, as seen in OneKey Pro and Ledger Stax) to store keys. These resist physical side-channel attacks—including electromagnetic and power analysis—providing robust protection against advanced threats.
Besides hardware wallets, various other approaches enhance private key security—users can choose based on individual needs:
1) Paper wallets: Printing private and public keys on paper provides simple, fully offline storage. However, precautions against fire, moisture, and loss are essential. Ideally, engrave keys onto metal plates (many options exist, e.g., OneKey’s KeyTag).
2) Mobile cold wallets: Using an offline phone or computer to store keys mimics hardware wallet benefits but requires self-management.
3) Sharded encrypted storage: Splitting the private key into parts stored separately increases difficulty for attackers—even partial access won’t reconstruct the key. But users must safeguard each shard to avoid permanent loss.
4) Multi-signature (Multisig): Requires multiple private keys to sign a transaction, preventing single-point compromise. For example, set up a three-key multisig wallet needing at least two approvals per transaction—enhancing security and enabling flexible control.
5) Cryptographic innovations: Emerging technologies like Threshold Signature Scheme (TSS) and Multi-Party Computation (MPC) distribute key management across parties, improving reliability. These are mostly enterprise-grade today, rarely used individually.
OKX Web3 Wallet Security Team: Hardware wallets isolate private keys on independent, offline devices, shielding them from online threats like malware and network attacks. Compared to software wallets or other storage forms, they offer superior protection—ideal for safeguarding large crypto holdings. Key private key protection strategies include:
1) Use trusted storage devices: Choose reputable hardware or cold storage solutions to reduce online exposure risks.
2) Strengthen security awareness: Be vigilant about entering private keys anywhere. When copying, paste only part and manually type the rest to prevent clipboard hijacking.
3) Securely store recovery phrases and keys: Avoid photos, screenshots, or digital notes. Write them down and keep in secure locations.
4) Split private key storage: Divide keys into segments stored separately to eliminate single points of failure.
Q4: What vulnerabilities currently exist in identity verification and access control?
OneKey Security Team: Unlike Web2 systems that store identity data, blockchain uses cryptography for self-custody and access. That means the private key *is* everything. The greatest risk in accessing crypto assets stems from poor private key management—after all, it’s the sole credential for asset access. If lost, stolen, exposed, or destroyed by natural disaster, assets may be permanently gone.
That’s why companies like OneKey exist—to offer secure self-custody solutions. Many users lack awareness, storing keys insecurely (e.g., in cloud docs or screenshots). Best practice is offline generation and storage—either manually (dice rolls, handwriting) or via hardware wallets paired with engraved metal backup plates.
Of course, many still rely on exchange accounts—where identity and access resemble Web2 models.
This brings password hygiene into focus. Weak or reused passwords are common—using easy-to-guess strings or repeating passwords across platforms (like email logins)—increasing susceptibility to brute-force attacks or breaches.
While multi-factor authentication (MFA)—SMS codes, Google Authenticator—can improve security, improper implementation creates new targets. SMS hijacking via SIM-swapping—where attackers trick carriers into transferring a victim’s number to a new SIM—is notorious. Vitalik himself suffered a “SIM SWAP” attack, enabling phishing campaigns that harmed others. Additionally, mismanaged MFA backup codes (e.g., for Google Authenticator) can be stolen and abused.
OKX Web3 Wallet Security Team: This is a crucial area. Current concerns include:
1) Weak and reused passwords: Users often pick simple, guessable passwords or reuse them across services, increasing vulnerability to brute-force attacks or leaks.
2) Inadequate Multi-Factor Authentication (MFA): While MFA boosts Web2 security, in Web3, once the private key leaks, attackers gain full control—making effective MFA difficult to implement.
3) Phishing and social engineering: Attackers use fake emails, spoofed websites, etc., to extract sensitive data. Today’s Web3 phishing sites operate professionally and at scale—without strong awareness, users easily fall victim.
4) Poor API key management: Developers sometimes hardcode API keys in client-side apps or fail to enforce proper permissions/expiry policies, leading to abuse if leaked.
Q5: How should users guard against emerging virtual technologies like AI face-swap?
OneKey Security Team: At BlackHat 2015, global hackers agreed facial recognition was the least reliable authentication method. A decade later, AI advancements have made near-perfect face replacement possible—confirming visual biometrics no longer suffice. Detection systems now need upgraded algorithms to identify deepfakes.
For users facing AI-swap risks, options are limited beyond protecting personal biometric data. Here are some suggestions:
1) Be cautious with facial recognition apps
Choose facial recognition apps with strong security records and transparent privacy policies. Avoid unknown or suspicious apps, and always update software to apply latest patches. In China, numerous loan apps have illegally sold user facial data, causing widespread leaks.
2) Understand Multi-Factor Authentication (MFA)
Relying solely on biometrics is risky. Combining multiple factors significantly improves security. MFA combines methods like fingerprints, iris scans, voiceprints, or even DNA. For verifiers, layered authentication adds resilience. For users, protecting such biometric data is equally important.
3) Stay skeptical and fraud-aware
With AI able to mimic faces and voices, impersonation over networks has become easier. Always double-check requests involving sensitive data or fund transfers—verify via call or in person. Stay alert to urgent demands and recognize common scams: fake executives, friends, or customer service reps. Beware too of counterfeit celebrity endorsements (“fake endorsements”) in projects.
OKX Web3 Wallet Security Team: Emerging virtual tech introduces new risks, which in turn drive innovation in defensive techniques—and eventually lead to new risk-mitigation products.
1. AI Forgery Risks
AI face-swap detection tools are emerging. Industry methods now focus on identifying unique artifacts (digital “fingerprints”) left by deepfake algorithms. Users can detect fakes by checking facial edges, lip sync errors, or audio-video desynchronization. Microsoft also offers educational tools to train users in recognizing deepfakes—helpful for boosting personal detection skills.
2. Data and Privacy Risks
Large language models bring data and privacy risks. When using chatbots, avoid entering private keys, API secrets, or passwords. Instead, obfuscate or substitute sensitive inputs. For developers, GitHub provides built-in checks—if OpenAI API keys or other secrets appear in commits, pushes will fail automatically.
3. Content Generation Abuse
Users increasingly encounter AI-generated content. While useful, misuse leads to misinformation and copyright issues. Detection tools now exist to flag machine-written text, reducing associated risks. Developers using AI for code generation must rigorously audit output for correctness and security—especially before open-sourcing or deploying sensitive code.
4. Ongoing Awareness and Learning
When browsing short videos, long-form content, or articles, actively question authenticity. Recognize telltale signs of AI forgery: robotic voices, pronunciation errors, unnatural facial blending. In critical situations, consciously assess potential risks.
Q6: From a professional standpoint, what physical device security recommendations do you have?
OneKey Security Team: Based on earlier discussions, here’s a summary of protective measures.
1. Guard against connected device intrusions
Connected devices are everywhere—but bring intrusion risks. To protect high-risk data (private keys, passwords, MFA backups), use strong encryption and favor air-gapped storage. Avoid storing sensitive data in plain text on devices. Stay alert to phishing and trojan threats. Consider separating devices: dedicate one solely to crypto operations, distinct from general-use devices. For example, use separate laptops—one for daily tasks, another only for wallet management—so compromise of one doesn’t jeopardize the other.
2. Maintain physical surveillance and protection
To further secure high-risk devices (e.g., hardware wallets), implement strict physical safeguards. Store them in high-security safes at home, ideally integrated with smart security systems including video monitoring and alarms. When traveling, prioritize hotels offering secure storage services—common in luxury accommodations—for added protection. Portable travel safes are also worth considering to protect critical devices anytime, anywhere.
3. Reduce exposure and prevent single points of failure
Distributing devices and assets is key to minimizing risk. Don’t concentrate all high-privilege devices or crypto holdings in one place or wallet. Spread them across geographically separate secure locations—home, office, trusted relatives. Use multiple hot wallets and cold hardware wallets, allocating portions of funds to each. This diversification reduces impact if one fails. For greater security, adopt multisig wallets requiring multiple signatures—raising the bar for unauthorized access.
4. Prepare emergency plans for worst-case scenarios
Anticipating worst-case threats is vital. High-net-worth individuals should stay low-profile to avoid becoming targets. Avoid flaunting crypto wealth publicly. Create contingency plans for lost or stolen devices: consider decoy wallets to placate potential robbers temporarily. Ensure critical device data can be remotely locked or wiped (with backups). When traveling in high-risk areas, hire private security teams, use VIP security lanes, and stay in high-security hotels to protect privacy and safety.
OKX Web3 Wallet Security Team: We’ll break this down into two levels: OKX Web3 App and user level.
1. OKX Web3 App Level
OKX Web3 Wallet employs multiple app-hardening techniques—including algorithm obfuscation, logic scrambling, code integrity checks, system library verification, anti-tampering mechanisms, and environment safety detection—to minimize hacking risks during usage. These also deter black-market repackaging, reducing chances of downloading fake versions.
Additionally, for wallet data security, we leverage cutting-edge hardware-based encryption. Sensitive data is encrypted at chip level and bound to the specific device—rendering stolen data unusable to anyone else.
2. User Level
For user devices—including hardware wallets, PCs, and smartphones—we recommend strengthening awareness in the following ways:
1) Hardware wallets: Use well-known brands, purchase from official sources, and generate/store private keys in isolated environments. Storage media should be fireproof, waterproof, and theft-resistant. Use secure safes, and consider splitting seed phrase backups across multiple secure locations.
2) Electronic devices: Prefer phones and computers with strong security and privacy track records (e.g., Apple). Minimize third-party app installations to maintain clean, secure systems. Use Apple ID for cross-device backup to avoid single-device failure.
3) Daily usage: Avoid performing sensitive wallet operations in public to prevent camera leaks. Regularly scan devices with reliable antivirus software. Periodically inspect the physical security of storage locations.
Finally, thank you for reading Issue 04 of OKX Web3 Wallet’s “Security Special.” We’re already preparing Issue 05—with real cases, risk identification insights, and actionable security guides. Stay tuned!
Disclaimer:
This article is for informational purposes only and does not constitute (i) investment advice or recommendations; (ii) an offer or solicitation to buy, sell, or hold digital assets; or (iii) financial, accounting, legal, or tax advice. Holding digital assets—including stablecoins and NFTs—involves high risk, with potential for significant volatility or complete loss of value. You should carefully consider whether trading or holding digital assets suits your financial situation. Please independently understand and comply with applicable local laws and regulations.
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
OKX
