OneKey says it has fixed the bug that got the hardware wallet hacked in 1 second

Crypto hardware wallet provider OneKey says it has already fixed a vulnerability in its firmware that allowed one of its hardware wallets to be hacked in one second.

On February 10, a YouTube video posted by cybersecurity startup Unciphered revealed that they had figured out a way to exploit a “massive critical vulnerability” to “open” a OneKey Mini.

According to Eric Michaud, a partner at Unciphered, by disassembling the device and inserting encryption, it was possible to return the OneKey Mini to “factory mode” and bypass the security pin, allowing a potential attacker to remove the mnemonic phrase used to restore a wallet.

“You have the CPU and the secure element. The secure element is where you store your crypto keys. Now, normally, the communication is encrypted between the CPU, where the processing is done, and the secure element,” Michaud explained.

“Well it turns out it wasn’t designed to do that in this case. So what you can do is put a tool in the middle that monitors the communications and intercepts them and then injects their own commands,” he said, adding:

“We made it where it then tells the secure element that it’s in factory mode and we can take out your memories, which is your money in crypto.”

But in a statement on February 10, OneKey said it had already addressed the security flaw identified by Unciphered, noting that the hardware team had updated the security patch “earlier this year” without “anyone being affected” and that “All disclosed vulnerabilities have been or is being fixed.”

“That said, with passphrases and basic security practices, even physical attacks revealed by Unciphered will not affect OneKey users.”

The company further highlighted that even if the vulnerability did apply, the attack vector identified by Unciphered cannot be used remotely and requires “disassembly of the device and physical access through a dedicated FPGA device in the lab to be possible to execute.”

According to OneKey, during correspondence with Unciphered, it was revealed that other wallets have been found to have similar issues.

“We also paid Unciphered bounties to thank them for their contribution to OneKey’s security,” OneKey said.

Related: ‘Haunts me to this day’ — Crypto project hacked for $4M in a hotel lobby

In its blog post, OneKey said it has already made great efforts to ensure the security of its users, including protecting them from supply chain attacks – when a hacker replaces a real wallet with one controlled by them.

OneKey’s measures have included tamper-proof packaging for deliveries and the use of Apple supply chain service providers to ensure strict supply chain security management.

In the future, they hope to implement native authentication and upgrade newer hardware wallets with higher-level security components.

OneKey noted that the main purpose of hardware wallets has always been to protect users’ money from malware attacks, computer viruses and other external dangers, but acknowledged that, unfortunately, nothing can be 100% secure.

“When we look at the entire hardware wallet production process, from silicon crystals to chip code, from firmware to software, it’s safe to say that with enough money, time and resources, any hardware barrier can be broken, even if it’s a nuclear weapons control system.”