Keep it safe

What it protects you from

Risk	With your DIY wallet
A device tampered with before it reached you	You chose generic parts nobody could tie to you, and installed every line of software yourself.
A recovery phrase someone generated in advance	Your phrase was created on your device at the moment you set it up, from electronic noise sampled by the hardware random number generator in its chip.
Malware on your computer	The computer never sees your keys. To move money it needs you to check the amount and address on the wallet’s screen and press its button.
A hidden network connection	Wi-Fi and Bluetooth are off and the wallet only accepts connections from the Pi itself. Its only link to the world is the USB cable to your computer.

What it doesn’t protect you from

Risk	Why
Someone stealing the device	There is no secure chip. With the device in hand, a thief can copy the memory card and guess your PIN on their own computer, without the device’s limit on attempts.
Someone seeing your recovery phrase	Whoever has the words has the money, with or without the device.
Approving the wrong transaction	The screen shows what you are signing. If you don’t read it, it can’t help you.
A flaw in the chip’s random number generator	Broadcom, who make the Pi’s chip, don’t publish how its generator works. The wallet tests every byte and stops if the output looks broken, but no test can prove that random numbers are unpredictable.
Mistakes in the code	The firmware and app are open, but open is not the same as checked. This is a self-built device; nobody has audited your build.

Close the gaps

Use all 9 PIN digits, but don’t rely on them. Your PIN is the key to the wallet stored on the memory card. Someone who steals the device can copy the card and try every PIN on their own computer, with no limit on attempts. A 4-digit PIN falls in seconds. Even 9 digits may only hold out for hours, or a day, against one graphics card. What really protects you is the passphrase below.

Add a passphrase. A passphrase is an extra word or sentence of your choosing that, together with your recovery phrase, opens a separate wallet. It is never stored on the device, so a thief who gets past the PIN still can’t reach that wallet. Keep your savings there.

On the device, open Security, then Passphrase, and choose Enable.
When the app opens the wallet, it asks for the passphrase. Choose Enter Passphrase on Device and type it with the joystick. That is slower, but the passphrase never touches your computer. Each different passphrase opens a different wallet, so enter it carefully.
Write the passphrase down, and keep it in a different place from your recovery phrase.

Or keep nothing on the card. If you chose Forget the wallet when unplugged on Your build, nothing is stored. A stolen device holds no wallet at all. The price is entering your recovery phrase each time you plug in.

Test a restore

Do this once, with a small amount in the wallet, before you rely on it:

On the device, open Security, then Check Recovery Phrase, and follow the steps. It confirms your paper copy matches.
For a full test, open Security, then Reset Device. This erases the wallet from the device.
Set the device up again with Import Wallet and your words.
In the app, check that the same receiving address appears as before.

Your recovery phrase works in any wallet that supports standard 12- or 24-word recovery phrases, including OneKey’s own devices. Your money doesn’t depend on this device, this site or this code.

If it’s lost or stolen

Assume the thief will eventually get past the PIN. Restore your recovery phrase on another device straight away, create a new wallet with a new phrase there, and move everything to it. A passphrase wallet buys you time; use it.

Day to day

Keep the wallet unplugged when you’re not using it.
Read the amount and the address on the device screen before every approval.
Only rebuild from code you’ve checked, as described in Customize.
Don’t install the official OneKey firmware updates the app may offer. They are for OneKey’s own devices.