OneKey

When it may not be suitable

• Frequent DApp operationsEach signature requires device confirmation, making frequent interactions more cumbersome.Consider a separate small-balance hot wallet for frequent interactions.
• Expecting account-based asset recoveryHardware wallets rely on user-managed recovery phrases. Losing the backup generally prevents account-based recovery.Users expecting account-based systems should understand the differences between exchange accounts and wallets.
• Unfamiliar with on-chain permissionsEven with offline private keys, an incorrect signature or malicious permission can cause losses.Learn signing implications, permission revocation and the intended chain's rules first.
• Purchasing through unofficial channelsUsed or unknown-source devices may be tampered with, supplied with preset recovery phrases or falsely packaged.Verify purchases through official or clearly authorized channels only.

Permission checks

1. Official domainUse the official domain to find downloads or device purchases, not group-chat links, advertising redirects or unfamiliar short links.Watch for fake websites, impersonated support and counterfeit download pages.
2. App-store or extension IDVerify the publisher, extension ID, version history, suspicious reviews and official announcements.Counterfeit apps and extensions with the same name can be misleading.
3. Recovery phrases and private keysKeep seed phrases, private keys, Keystore and recovery phrases offline. Do not screenshot, upload or send them to anyone.Possession of the recovery phrase gives control over the assets.
4. Signing promptsCheck the contract, chain ID, allowance, recipient and signed-message contents individually.A malicious permission request may not look like an ordinary transfer.
5. Revoke permissionsFind the relevant chain's allowance-checking and revocation tools, and regularly revoke unused DApp permissions.Persistent unlimited allowances increase exposure to future risks.
6. Small-amount testTest with a small amount before first use, changing devices, bridging or making a large transfer.Incorrect address formats, Memo/Tag or network selection can result in lost assets.