Open-source hardware wallet with a secure element at $79, combining transparent firmware with dedicated security hardware in OneKey's mid-range lineup.
The OneKey Classic 1S Pure is a solid mid-range option at $79 with a strong security foundation. Its EAL6+ secure element, open-source firmware, and reproducible builds offer a verifiable trust chain rare at this price point. No Bluetooth, NFC, or QR connectivity limits it to USB-only workflows, making it a poor fit for mobile-first or air-gapped users.
The OneKey Classic 1S Pure uses an EAL6+ certified secure element — the same certification tier as the Ledger Stax and above the EAL5+ found in Trezor Safe 3. The specific SE chip model is not publicly disclosed by OneKey, which is a transparency gap worth noting. EAL6+ means the chip has passed formal verification methods and semi-formal design analysis, making physical extraction attacks significantly harder than on EAL5+ devices.
Firmware is open source and supports reproducible builds, meaning anyone can verify that the binary running on the device matches the published source code. This is a meaningful advantage over Ledger, whose firmware remains closed source despite years of community pressure. Firmware updates are signed by OneKey — the signing key infrastructure details are vendor-described but not independently audited to my knowledge.
Genuine device verification is supported, allowing users to confirm the device hasn't been tampered with in transit — vendor claims this works via SE attestation, though the specific cryptographic mechanism isn't fully documented in public-facing technical docs.
Secure element: EAL6+ certified (chip model undisclosed)
Firmware: Open source, reproducible builds confirmed
Genuine check: SE-based attestation (vendor-claimed, not independently verified)
Known CVEs: None publicly documented at time of writing
Compared to Trezor Model One (no secure element at all) and Ledger Nano X (EAL5+ SE, closed firmware), the Classic 1S Pure holds a stronger position on both SE certification and firmware transparency simultaneously — a combination few devices offer at this price point.
SecurityKey Factor
The OneKey Classic 1S Pure generates a 12-word BIP39 seed phrase on-device during setup. BIP39 is the industry standard, compatible with virtually every major wallet for recovery purposes. Notably, the device does not support SLIP39 (Shamir Secret Sharing), which means you cannot split your backup into multiple shares — a limitation compared to the Trezor Model T, which supports Shamir natively.
Backup options are limited to the standard seed phrase written on paper. There is no proprietary multi-card backup system (unlike Ledger's Recover subscription service, which is controversial anyway) and no native metal backup solution bundled in the box. Third-party metal backup plates like Cryptosteel are compatible since it's standard BIP39.
Passphrase support is included, enabling hidden wallets — a critical feature for plausible deniability under coercion. The passphrase is entered on-device, not via a connected computer, which is the correct implementation from a security standpoint.
Recovery on a new device is straightforward: any BIP39-compatible wallet (Electrum, BlueWallet, another OneKey device, Trezor, etc.) can restore from the 12-word seed. The process takes under 5 minutes on a replacement device.
If the device is lost or broken, funds are fully recoverable from the seed phrase alone — no dependency on OneKey's servers or services. This is the expected behavior but worth confirming explicitly. The 12-word default (vs. 24-word on Ledger Nano X) does reduce entropy slightly, though 128-bit security from 12 words remains computationally unbreakable with current technology.
Recovery & backups
The Classic 1S Pure measures 86mm × 52mm × 5.2mm and weighs 18.3g — thinner and lighter than the Ledger Nano X (72mm × 18.6mm × 11.1mm) and more card-like in form factor. The 2-inch OLED display is the largest screen in OneKey's Classic lineup and is readable in most lighting conditions, though OLED contrast can wash out in direct sunlight.
Navigation uses physical buttons rather than a touchscreen. For users coming from Trezor Model One or Ledger Nano S Plus, the button-based interface will feel familiar. First-time setup involves generating or importing a seed, setting a PIN, and installing the OneKey desktop or mobile app — typically completable in 10–15 minutes.
The OneKey companion app supports Windows, macOS, Linux, iOS, and Android — full cross-platform coverage. The app UI is clean and supports portfolio tracking, token management, and firmware updates. Daily transaction workflow: connect via USB, confirm address on-device, approve transaction on the 2-inch screen. No Bluetooth or NFC means every interaction requires a physical USB cable, which some users will find inconvenient compared to the Ledger Nano X (Bluetooth) or Keystone 3 Pro (QR-based air-gap).
The learning curve is low for anyone who has used a hardware wallet before. True beginners may need 30–60 minutes to understand seed phrase security concepts, but the OneKey app provides setup guidance. Power users wanting air-gapped QR signing will find this device limiting — the Classic 1S Pure has no camera or QR output capability.
Usability / UX
The OneKey Classic 1S Pure supports over 1,000 tokens across multiple networks. Key L1 chains include Bitcoin, Ethereum, Solana, BNB Chain, Avalanche, Polygon, and Tron — covering the majority of DeFi and NFT activity by TVL. The breadth here is competitive with Ledger's Live app ecosystem, though Ledger's app library covers more obscure chains via installable coin apps.
Third-party wallet compatibility includes MetaMask (via USB), Electrum (Bitcoin), and BlueWallet — standard integrations for a USB-connected hardware wallet. WalletConnect is supported through the OneKey app and compatible browser extensions, enabling DeFi protocol interaction. NFT display and management is available within the OneKey app.
The absence of WebUSB support is a limitation — it means the device cannot connect directly to browser-based interfaces without the OneKey bridge software installed, adding friction compared to devices like the Trezor Model T which supports WebUSB natively. No Bluetooth or NFC also rules out wireless integrations available on the Ledger Nano X.
Multisig support is described as basic — it can participate in multisig setups but lacks the advanced PSBT workflow and coordinator software integration that ColdCard MK4 offers for Bitcoin-focused multisig users.
Ecosystem & integrations
The OneKey app does not require account registration to use the device — you can set up and operate the wallet without providing an email address or personal data. This is a baseline privacy requirement that OneKey meets, unlike some competitors that push cloud account creation.
Telemetry behavior in the OneKey app is not fully documented in public-facing privacy policies at the level of detail that would allow independent verification. Whether analytics are opt-in or opt-out by default is not clearly disclosed — treat this as unverified.
The device operates fully offline for signing — no network connection required on the hardware itself. The companion app communicates with blockchain nodes to broadcast transactions; using a custom node or routing app traffic through a VPN is technically possible but not a built-in feature. Tor support is not natively integrated into the OneKey app, unlike Wasabi Wallet (which you could pair with a different hardware wallet for CoinJoin).
CoinJoin is not supported natively. For Bitcoin privacy, this is a significant gap versus ColdCard MK4, which integrates with JoinMarket and Sparrow's CoinJoin implementation, or Foundation Passport, which works seamlessly with Sparrow for Whirlpool CoinJoin. Users with serious Bitcoin privacy requirements should look at those alternatives.
Ledger Nano X: $149 — nearly double the price, offers Bluetooth and EAL5+ SE, but closed firmware
Trezor Safe 3: $79 — identical price, EAL6+ SE (Infineon SLx 9670), open source, but no genuine check attestation
Ledger Nano S Plus: $79 — same price, EAL5+ SE, closed firmware, no reproducible builds
ColdCard MK4: $147.94 — nearly double, Bitcoin-only focus, superior for advanced Bitcoin users
Foundation Passport Batch 2: $199 — significantly more expensive, air-gapped QR, open source hardware
At $79, the Classic 1S Pure competes directly with the Trezor Safe 3 and Ledger Nano S Plus. Against the Trezor Safe 3, it offers a larger 2-inch OLED display and comparable security specs. Against the Nano S Plus, it wins on firmware transparency (open source + reproducible builds) while matching on price.
Best value for: Users who want open-source firmware with a certified secure element under $80, and who prioritize broad token support over Bitcoin-specific features.
Pay more if: You need air-gapped QR signing (Keystone 3 Pro, $169), advanced Bitcoin multisig (ColdCard MK4), or Bluetooth convenience (Ledger Nano X).
Pay less if: You only hold Bitcoin and are comfortable with Trezor Model One ($59) despite its lack of a secure element.
Price & value
The OneKey Classic 1S Pure is a well-rounded, security-focused hardware wallet that punches above its $79 price point thanks to a certified EAL6+ secure element, fully open-source firmware, and reproducible builds — a combination that remains rare at this tier.
Buy this wallet if:
You are a security-conscious user who insists on auditable, open-source firmware and wants the peace of mind that comes with EAL6+ hardware certification without paying a premium price.
You manage a diverse portfolio spanning more than 1,000 tokens and need broad chain support in a slim, lightweight device (just 18.3 g) that fits comfortably in a pocket or travel bag.
You are a desktop-first user on Windows, macOS, or Linux who prefers a straightforward USB connection and does not need wireless features like Bluetooth or NFC cluttering the attack surface.
Skip this wallet if:
You need air-gapped signing via QR codes — the Classic 1S Pure lacks that capability entirely. Consider the Keystone 3 Pro ($149) instead, which is purpose-built for QR-based, air-gapped workflows.
You require Shamir Secret Sharing for advanced backup redundancy. The Trezor Model T ($219) supports SLIP39 Shamir backups and may better suit users with complex key-management needs.
You rely heavily on mobile and want Bluetooth or NFC for on-the-go signing — the Ledger Nano X ($149) offers Bluetooth connectivity for a more seamless mobile experience.
If choosing between the OneKey Classic 1S Pure and the Ledger Nano X ($149), the OneKey wins on transparency — its fully open firmware and reproducible builds are a meaningful advantage for trust-minimized security — while the Nano X wins on wireless flexibility. If choosing between the OneKey Classic 1S Pure and the Trezor Model One ($59), the OneKey justifies its $20 premium with a larger 2-inch OLED display, a higher-grade secure element (EAL6+ vs. no dedicated SE), and genuine-check support.
At $79, the OneKey Classic 1S Pure earns its place as a credible, transparent choice for security-minded holders who want open-source assurances and strong hardware credentials without overspending — refer to the full review score above for the complete breakdown.
✓ Our Verdict
The OneKey Classic 1S Pure is a well-rounded, security-focused hardware wallet that punches above its $79 price point thanks to a certified EAL6+ secure element, fully open-source firmware, and reproducible builds — a combination that remains rare at this tier.
Buy this wallet if:
You are a security-conscious user who insists on auditable, open-source firmware and wants the peace of mind that comes with EAL6+ hardware certification without paying a premium price.
You manage a diverse portfolio spanning more than 1,000 tokens and need broad chain support in a slim, lightweight device (just 18.3 g) that fits comfortably in a pocket or travel bag.
You are a desktop-first user on Windows, macOS, or Linux who prefers a straightforward USB connection and does not need wireless features like Bluetooth or NFC cluttering the attack surface.
Skip this wallet if:
You need air-gapped signing via QR codes — the Classic 1S Pure lacks that capability entirely. Consider the Keystone 3 Pro ($149) instead, which is purpose-built for QR-based, air-gapped workflows.
You require Shamir Secret Sharing for advanced backup redundancy. The Trezor Model T ($219) supports SLIP39 Shamir backups and may better suit users with complex key-management needs.
You rely heavily on mobile and want Bluetooth or NFC for on-the-go signing — the Ledger Nano X ($149) offers Bluetooth connectivity for a more seamless mobile experience.
If choosing between the OneKey Classic 1S Pure and the Ledger Nano X ($149), the OneKey wins on transparency — its fully open firmware and reproducible builds are a meaningful advantage for trust-minimized security — while the Nano X wins on wireless flexibility. If choosing between the OneKey Classic 1S Pure and the Trezor Model One ($59), the OneKey justifies its $20 premium with a larger 2-inch OLED display, a higher-grade secure element (EAL6+ vs. no dedicated SE), and genuine-check support.
At $79, the OneKey Classic 1S Pure earns its place as a credible, transparent choice for security-minded holders who want open-source assurances and strong hardware credentials without overspending — refer to the full review score above for the complete breakdown.
Ready to buyOneKey Classic 1S Pure?
We may earn a commission if you purchase through our links. This doesn't affect our editorial independence.
Impermanent loss happens when asset prices in a liquidity pool diverge from external markets, reducing the value of liquidity providers' holdings compared to simply holding the assets.
EAL Certification (Evaluation Assurance Level) from Common Criteria rates the security of hardware components, like secure chips in crypto hardware wallets. Higher levels, such as EAL5+ or EAL6+, indicate stronger resistance to attacks.
Reproducible Builds refer to the process where the same source code consistently produces identical binary outputs, ensuring verifiable and trustworthy software in blockchain and crypto projects.
Firmware Attestation is the process of verifying the authenticity of a device's firmware to ensure it has not been tampered with, commonly used in hardware wallets for security.
BIP39 is a standard for generating mnemonic seed phrases that are used to create deterministic wallets and securely back up cryptocurrency private keys.
Recovery is the process of restoring access to a cryptocurrency wallet using its seed phrase or mnemonic backup if the original wallet is lost or inaccessible.
Shamir Secret Sharing (SSS) divides a secret, like a crypto wallet seed, into multiple shares. A threshold number of shares reconstructs it, enhancing security as in SLIP-39 backups.
A backup in cryptocurrency is a secure copy of a wallet's seed phrase or private keys. It enables recovery of funds if the original wallet is lost or damaged.
A metal backup is a durable metal plate or device engraved with a cryptocurrency wallet's seed phrase, providing fireproof and waterproof protection for offline key storage.
A passphrase is an additional security layer for cryptocurrency wallets, acting as a 25th word in the BIP39 seed phrase, protecting access to hidden wallets.
Plausible Deniability refers to the ability to deny knowledge or possession of cryptocurrency by using techniques like decoy wallets or hidden volumes, ensuring privacy under duress.
Electrum is a lightweight Bitcoin wallet that allows users to store, send, and receive Bitcoin securely. It is known for its speed and low resource usage.
BlueWallet is a mobile Bitcoin wallet that allows users to securely store, send, and receive Bitcoin. It offers features like Lightning Network support and multi-sig capabilities.
A companion app is a software application used to manage and interact with cryptocurrency wallets or blockchain networks, typically offering features like transactions and security controls.
Telemetry in cryptocurrency and blockchain refers to the automatic collection and transmission of anonymous usage data, metrics, and error reports from wallets or nodes to improve software.
Bitcoin (BTC) is the first decentralized cryptocurrency, launched in 2009. It uses blockchain technology for secure, peer-to-peer digital transactions without intermediaries.
Ethereum is a decentralized blockchain platform that enables smart contracts and decentralized applications (dApps). Its native cryptocurrency is Ether (ETH).
Solana is a high-performance layer-1 blockchain platform that enables fast, low-cost transactions using Proof of History and Proof of Stake. Its native token is SOL.
BNB Chain is a high-performance blockchain network developed by Binance, formerly Binance Smart Chain (BSC). It supports smart contracts, DeFi, and uses BNB as its native token.
Avalanche (AVAX) is a scalable layer-1 blockchain platform that achieves high throughput and sub-second transaction finality using its novel proof-of-stake consensus.
Polygon is a layer-2 scaling solution for Ethereum that enables faster, cheaper transactions via its Proof-of-Stake sidechain. Native token: MATIC (also called Polygon PoS).
TRON is a blockchain platform and cryptocurrency (TRX) designed for high-throughput decentralized applications, especially in content sharing and entertainment.
DeFi (Decentralized Finance) refers to a set of financial services, such as lending and trading, built on blockchain technology without traditional intermediaries like banks.
An NFT (Non-Fungible Token) is a unique digital asset stored on a blockchain, representing ownership of a specific item, such as artwork, music, or virtual goods.
UTXO (Unspent Transaction Output) is a unit of cryptocurrency from a previous transaction that remains unspent and serves as input for new transactions in blockchains like Bitcoin.
WalletConnect is a protocol that enables secure communication between decentralized applications (dApps) and mobile wallets through QR code scanning or deep linking.
WebUSB is a browser API that lets web apps communicate directly with USB-connected hardware wallets for secure crypto transactions without plugins or native apps.
Multisig (multi-signature) is a security feature that requires multiple private keys to authorize a transaction, enhancing protection against unauthorized access in blockchain networks.
PSBT (Partially Signed Bitcoin Transaction) is a Bitcoin transaction format that allows multiple parties to sign a transaction incrementally before finalizing it.
CoinJoin is a privacy technique in cryptocurrency where multiple users combine their transactions, making it harder to trace individual senders and receivers.
HODL is cryptocurrency slang for holding assets long-term despite price volatility, rather than selling. It originated from a 2013 forum post misspelling 'hold' as 'I AM HODLING.'
Offline Signing refers to signing cryptocurrency transactions on a device that is not connected to the internet, ensuring private keys remain secure from online threats.
Bluetooth Connectivity enables wireless communication between devices, like hardware wallets and smartphones, using Bluetooth or Bluetooth Low Energy (BLE) for secure data transfer.
Open Source Firmware refers to firmware in hardware devices, like wallets, where the source code is publicly available, allowing transparency, auditability, and customization.
OneKey Classic 1S Pure uses a certified Secure Element chip to store private keys in tamper-resistant hardware. Even if the device's software were compromised, the Secure Element isolates your keys from extraction. The firmware is open-source, meaning security researchers worldwide can audit the code for vulnerabilities. The device has been independently security audited.
What if OneKey goes out of business?
OneKey's firmware is open-source — even if the company disappears, the community can maintain the software. Your seed phrase works with any BIP39-compatible wallet, so your funds are always recoverable.
What if I lose my OneKey Classic 1S Pure?
Your cryptocurrency is stored on the blockchain, not on the device. If you lose your OneKey Classic 1S Pure, you can recover full access using your seed phrase on any compatible wallet.
How long will OneKey Classic 1S Pure receive security updates?
Check OneKey's website for the latest firmware update schedule.
Is the OneKey Classic 1S Pure safe to use?
Yes. The OneKey Classic 1S Pure is built around a CC EAL6+ certified Secure Element, one of the highest security certifications available in consumer hardware wallets. It supports open-source firmware with reproducible builds, meaning anyone can verify the code running on the device. A genuine device check is also built in to detect tampering before first use. Private keys never leave the device, and offline signing ensures transactions are signed in an air-gapped environment. For most users, this represents a very strong security posture.
OneKey Classic 1S Pure vs Ledger Nano X: which is better?
Both are solid hardware wallets, but they differ in key areas:
Security transparency:OneKey Classic 1S Pure has fully open-source, reproducible firmware; Ledger's firmware is closed-source.
Connectivity:Ledger Nano X adds Bluetooth; the Classic 1S Pure is USB-only — a deliberate choice to reduce attack surface.
Price: At $79, the Classic 1S Pure undercuts the Nano X (~$149).
Secure Element: OneKey uses EAL6+; Ledger uses EAL5+/EAL6 depending on the model.
If open-source software and lower price matter most, the Classic 1S Pure has an edge.
How many coins does the OneKey Classic 1S Pure support?
The OneKey Classic 1S Pure supports over 1,000 tokens and cryptocurrencies, covering major blockchains including Bitcoin, Ethereum, and most EVM-compatible networks, as well as a wide range of ERC-20 and other standard tokens. It connects via USB to the OneKey desktop and mobile apps (available on Windows, macOS, Linux, iOS, and Android) which manage the full asset list. Support is regularly expanded through firmware and app updates.
Are there any known vulnerabilities or concerns with the OneKey Classic 1S Pure?
No critical vulnerabilities have been publicly disclosed for the Classic 1S Pure specifically. OneKey is a relatively newer brand compared to Ledger or Trezor, which some users consider a trust concern. However, the company mitigates this through fully open-source firmware, reproducible builds, and a public bug bounty program. The EAL6+ Secure Element also provides hardware-level resistance to physical extraction attacks. As with any hardware wallet, the main risk remains user error — losing the seed phrase or falling for phishing attacks targeting the companion app.
Is the OneKey Classic 1S Pure worth the $79 price?
At $79, the OneKey Classic 1S Pure offers exceptional value for its security tier. You get an EAL6+ Secure Element, open-source and reproducible firmware, a 2-inch OLED display, and support for 1,000+ assets — features that competitors often charge $100–$150 for. The trade-offs are no wireless connectivity (no Bluetooth or NFC) and no Shamir Secret Sharing for backup. If you prioritize security transparency over wireless convenience and don't need advanced backup schemes, it is very much worth the price.
Does the OneKey Classic 1S Pure support a passphrase and BIP39 recovery?
Yes. The OneKey Classic 1S Pure uses the standard BIP39 seed phrase format with a 12-word recovery phrase. It also supports an optional BIP39 passphrase (sometimes called the 25th word), which adds an extra layer of protection — even if your seed phrase is compromised, funds remain inaccessible without the passphrase. Note that Shamir Secret Sharing (SSS) is not supported, so multi-share backup schemes are not available on this device.
Can I use the OneKey Classic 1S Pure with my iPhone or Android phone?
Yes. The OneKey Classic 1S Pure is compatible with both iOS and Android via the OneKey mobile app. Connection is made through USB using an appropriate cable or adapter (e.g., USB-C to Lightning for older iPhones). There is no Bluetooth or NFC support, so a physical cable connection is always required on mobile. The wallet also works with the OneKey desktop app on Windows, macOS, and Linux.
Some links on this page are affiliate links. If you purchase through them, I may earn a commission at no additional cost to you. This helps support the site and allows me to continue creating detailed, independent reviews.
Our testing methodology is evolving. Ratings and assessments will be refined as we improve our scoring framework to reflect the most accurate results.
