
PANews|Oct 17, 2025 14:27
[OneKey Responds to Milk Sad Incident: Confirms Vulnerability Does Not Affect Security of Its Software and Hardware Wallets]
According to OneKey's Chinese Twitter account, in response to the recent "Milk Sad Incident" involving a random number vulnerability, the OneKey team clarified that this vulnerability does not affect the security of the mnemonic phrases and private keys of OneKey's software and hardware wallets.
The vulnerability originates from the use of a pseudo-random number generator based on system time and the Mersenne Twister-32 algorithm in version 3.x of Libbitcoin Explorer (bx). The seed space is only 2³² bits, allowing attackers to deduce private keys through prediction or brute force. The affected range includes some older versions of Trust Wallet and all products using bx 3.x or older versions of Trust Wallet Core.
OneKey stated that its hardware wallets use EAL6+ secure chips with built-in TRNG (True Random Number Generator). Older devices have also passed SP800-22 and FIPS140-2 entropy tests. The software wallets use system-level CSPRNG entropy sources to generate random numbers, meeting cryptographic standards. The team emphasized that users are advised to manage their assets with hardware wallets and should not import mnemonics generated by software wallets into hardware wallets to ensure maximum security.
Share To
Timeline
HotFlash
APP
X
Telegram
CopyLink