OneKey is the hardware wallet that checks the most boxes on paper: open-source, reproducible firmware; EAL6+ secure elements; and on the Pro, QR air-gap signing. If you want a device, it is a strong pick. Coldstar's case against it is price, scripting, and policy.
OneKey Pro as the personal vault; Coldstar as the programmable cold root behind automated flows.
| Coldstar | OneKey | |
|---|---|---|
| Upfront cost | ~$10 — any USB drive. The software is free and MIT-licensed. | Classic 1S $99 (Pure $79); Pro $278. |
| Where the key lives | AES-256-GCM encrypted keyfile on a drive you own. Plaintext exists only in memory-locked RAM for the ~100 µs it takes to sign, then is zeroized. | Classic 1S: one EAL6+ secure element. Pro: four EAL6+ secure elements. |
| How a transaction reaches the key | Build online → QR (or file) to an offline machine → sign → QR back → broadcast. Fully air-gapped; the drive is storage, not a signer. | Classic 1S: USB-C and Bluetooth (not air-gapped). Pro: QR camera for air-gapped signing, plus USB-C, Bluetooth, NFC. |
| Source code | Open source (MIT) — every line that touches the key is readable on GitHub. | Firmware and apps fully open source and reproducible; audited by SlowMist. |
| What you trust | Code you can read, plus your own offline machine. No vendor silicon, firmware, cloud, or account. | Open firmware you can reproduce, the SE vendors, and OneKey's release signing. |
| Recovery | Passphrase + encrypted keyfile. The drive is disposable: lose it and the file is useless without the passphrase; re-flash a new one. | BIP39; passphrase (Pro: attach-to-PIN hidden wallets); optional OneKey Lite NFC backup card. No cloud recovery. |
| Automation & policy | CLI-first, scriptable, headless. Policy-gated agent signing: limits, allowlists, rate caps, escalation to air-gapped approval. | None. On-device confirmation (fingerprint on Pro). |
| Solana wallets | Coldstar CLI and Seeker app. | OneKey app (100+ chains). Direct Phantom or Solflare hardware connection not documented. |
| Maturity | Beta — independent audit planned before the production release. | Shipping product line with third-party audit. |
OneKey's openness is real and rare among hardware vendors. If you are choosing a device, it belongs on the shortlist with Trezor and Keystone. Coldstar is the option when the device itself is the thing you want to remove.
OneKey and Coldstar both let you read the code. OneKey goes a step further than most vendors with reproducible builds, so you can verify the binary on the device matches the source. The remaining trust is in the secure element vendors and in OneKey's update signing.
Coldstar removes the device. The key is an encrypted file; the signer is an offline computer; the code is MIT. What you gain is scriptability and a near-zero marginal cost per wallet. What you give up is a certified chip guarding a seed at rest, which Coldstar replaces by never having a plaintext seed at rest.
OneKey is a shipping, audited product. Coldstar is beta, pre-audit.
Because you may not want a device at all: for a treasury with many signers, or an agent that must sign under policy without a human present, hardware with a fingerprint reader is the wrong shape. For a single personal wallet, OneKey is a fine choice.
No; it connects over USB-C or Bluetooth. Only the Pro has the QR camera for air-gapped signing.
OneKey documents its own app for Solana. We did not find a direct Phantom or Solflare hardware connection on OneKey's pages at review time.
Open source, MIT. macOS, Linux, Windows — and on the Solana Seeker dApp Store.
pip install coldstar
Third-party facts were checked against the vendor's own pages on the date above. Pricing and feature sets change; if something here is out of date, tell us and we will fix it.