OneKey Mini and Touch seed extraction via secure element bus
Who is affected
An attacker with an affected device in hand and lab equipment could extract the seed phrase. OneKey states the issue is patched and no users were affected.
What happened
On 10 February 2023 the security firm Unciphered published a video showing it could recover the recovery phrase from a OneKey Mini. According to The Block, the wallet’s main processor and its secure element communicated without encryption, and the researchers placed an FPGA between the two chips to intercept and inject commands. Cointelegraph reports that they disassembled the device, put it into factory mode and bypassed the PIN.
The NVD entry CVE-2023-25758 describes OneKey Touch devices through 4.0.0 and OneKey Mini devices through 2.10.0 as allowing an attacker to obtain the seed phrase after disassembling the device, rated CVSS 3.1 4.2 (Medium) with a physical attack vector and high attack complexity.
OneKey states that the attack cannot be carried out remotely and requires the victim’s device plus specialised equipment, that it had already shipped a security patch, that no users were affected, and that it paid Unciphered a bug bounty. The fixed firmware version has not been published.
A mnemonic phrase is a set of words that stores a cryptocurrency wallet's private keys, allowing users to recover access if lost.
Read full definitionA secure element is a tamper-resistant chip built to store secrets and resist physical attacks such as side-channel analysis and fault injection.
Read full definitionPIN Protection is a security feature that requires a personal identification number (PIN) to access a cryptocurrency wallet or device, preventing unauthorized access.
Read full definitionFirmware is the software that runs on a hardware wallet itself: it generates keys, shows transaction details on the screen and signs.
Read full definitionSources
Independent reporting and research this entry was checked against.
Learn more
Guides on protecting yourself against this type of incident (Hardware attack) and the glossary terms that describe it.
Can Hardware Wallets Be Hacked?
Hardware wallets are extremely secure, but not invincible. Understand the real risks and attack vectors.
Read GuideEvil Maid Attack: Protecting Unattended Hardware Wallets
Someone accesses your wallet while you are away. Hotel rooms, offices, shared spaces — how to detect and prevent physical tampering.
Read GuideProtecting Your Hardware Wallet from Physical Theft
What happens if someone steals your hardware wallet? How to set up layers of protection so theft alone cannot compromise your crypto.
Read GuideFault Injection
Fault injection disturbs a chip's voltage, clock or electromagnetic environment so that it skips a security check or leaks data.
Side-Channel Attack
A side-channel attack in cryptocurrency and blockchain targets indirect information, like power usage or timing, to extract sensitive data from a system or device.
Secure Element
A secure element is a tamper-resistant chip built to store secrets and resist physical attacks such as side-channel analysis and fault injection.
Evil Maid Attack
An evil maid attack is a physical security threat where an attacker gains temporary unsupervised access to a hardware wallet to tamper with it, install malicious firmware, or extract private keys.
Cite this entry
WalletInsights. “OneKey Mini and Touch seed extraction via secure element bus”. Hardware wallet security incident tracker. Last verified November 3, 2026. https://walletinsights.io/en/security-incidents/onekey-mini-secure-element-bus-interception-2023/
Corrections and right of reply
Vendors, researchers and readers can send corrections or statements to security@walletinsights.io. We check them against the sources, update the entry and record the change in its log.