OneKey Publishes a Photo Check for Tampered Hardware Wallet Boards

OneKey released a free web tool in the early hours of Thursday that reads a photograph of a hardware wallet's circuit board and flags components that look wrong. It covers OneKey's own devices and those made by Ledger and Trezor, which the project says are held to the same checks. Nothing has to be registered, and the site says uploaded photos are not stored. The company's founder, who posts as Yishi, announced it on X with the limit written into the announcement.

"it can flag what looks wrong, but a clean result isn't an all-clear," the post said.

What the check actually looks at

One outlet carries the mechanism. TechFlow, publishing at 00:51 UTC, says the check runs on Anthropic's Claude vision model, that the user uploads photographs of a disassembled motherboard instead of a sealed device, and that metadata including geolocation is stripped locally before anything leaves the browser. The verdict comes from preset rules, not from the model's own conclusion. What those rules look for is narrow: a board that does not match the model it claims to be, wrong text on the main chip, and chips, modules, antennas or jumper wires with no reason to be there.

The stated limits run long. The tool cannot see firmware or software, cannot look inside a chip, cannot see under a shielding can or beneath the screen, and cannot separate a counterfeit chip from a genuine one when the two look alike. TechFlow has the project describing results as "for reference only" and says they "cannot serve as a definitive security certification". TokenPost calls the output a screening signal. Owners are pointed back to manufacturer verification either way.

The name is told three ways

Four outlets call the tool tampered.app, which is the domain it sits on. TechFlow calls it the OneStone Wallet Inspector in its body and the One-Stone Package Inspector in its own headline, adds a Chinese name beside both, and reconciles none of the three. The domain is the only form more than one outlet uses, and this piece follows it. The founder's name goes the same way. TokenPost and PANews call him Yishi and carry the handle he posts under; Bloomingbit, covering his posts about Ledger last week, renders the same person as Yi He. Neither account corrects the other.

One accuracy figure, and it is the vendor's

TokenPost and PANews both report that the tool was tested against about 400 user-submitted photographs and returned accuracy above 95%. Both attribute it to the founder, so that is one claim carried twice, not two findings. TechFlow gives no accuracy figure. No independent test has been published.

The occasion is six days old. Hardware wallet owners in Southeast Asia lost assets on 9 October, with the total put at about $90 million by Bloomingbit, the only outlet in this sweep to carry a figure, and with the exact amount and the route in still under investigation when it published. Ledger had already told buyers from one reseller not to set up their devices. OneKey's founder said then that an attack of that shape could involve a malicious device placed inside the hardware, able to capture a recovery phrase as the screen displays it, and that there was no evidence this is what happened. It stands unverified.

The part no photograph reaches

A board is one layer of a device that has several. OneKey has said it intends to move recovery phrases onto a backup card over an encrypted link instead of showing them on screen, encrypt the communications inside its wallets, add anti-tamper protection to packaging and tighten its oversight of authorised sellers. None of that carries a date. Confidence in a sealed box bought from a third party has had a rough autumn, and Coldcard said this month that a phishing link went out from its own X account. A free checker that reads one photograph and refuses to certify anything is a modest answer. Whether enough owners will open a device to use it is the number nobody has.