OneKey Neo vs Tangem Wallet (3 Cards)

After Ledger found hardware implants in Ledger devices sold by the reseller CryptoBilis, OneKey ended CryptoBilis’s authorization, paused new resellers and began reviewing existing ones. OneKey says no OneKey user has reported losing funds and does not report finding a tampered OneKey device.

As a precaution, OneKey replaces for free any OneKey model bought from CryptoBilis between 1 March and 12 October 2026, activated or not, with proof of purchase. Apply through OneKey support by 31 December 2026; the old device does not need to be returned.

OneKey’s advice: do not activate an unused CryptoBilis unit. If a device from CryptoBilis already holds funds, move them now to a wallet with a newly generated recovery phrase rather than waiting for the replacement.

This concerns one reseller, not the device design, so it does not change our ratings.

Ledger’s Donjon security team, which works for a competing manufacturer, published a laser fault-injection attack on Tangem cards on 9 July 2026. With a card physically in hand, the researchers opened it and used precisely timed laser pulses to skip a check, which let them set a new access code without knowing the old one and then sign transactions. The private key is not extracted. According to Donjon, the attack applies to all Tangem cards in circulation, and because the cards have no firmware update mechanism it cannot be patched on cards already sold.

The attack requires stealing the card, visibly damaging it, laboratory equipment costing roughly $250,000 and specialist skills. Tangem calls the risk to everyday users “virtually non-existent” and says no funds have been lost to this method; none has been reported in the wild.

What this means for owners: the practical exposure is a lost or stolen card. Keep track of your cards, and if one goes missing, move funds to a wallet the missing card cannot access.