UKey Firmware Passes CertiK Audit Publicly
The open firmware now carries zero open findings, though the full device has not been reviewed and hardware transparency remains on the roadmap.
Updated on Nov. 3, 2026 in Quantum Computing
Live Poll
Would you trust a hardware wallet's security more after an independent audit?
UKey announced that its latest firmware release was independently audited by CertiK, with all identified issues remediated and no open findings at audit close. The firmware source code is published in a public repository at release tag 1.5.0, and the review covered the firmware only, not the device as a whole. The development is shipped, not research-stage.
Why it matters
Firmware generates keys, approves transactions and mediates device connections, which is why UKey began its open-source and audit program there. The move reflects a broader push for verifiable security claims in hardware wallets, where users cannot inspect code by default.
The evidence is a CertiK audit of the firmware codebase, with the firmware source published under release tag 1.5.0 and zero open findings after fixes were closed through CertiK's review. The review scope was limited to firmware, and the device as a whole was not assessed.
The players
UKey
A hardware wallet maker whose products are sold through JD.com, publishing its firmware source as part of an open-source and audit program.
CertiK
A blockchain security firm that audited UKey's firmware and operates the Skynet monitoring platform that tracks UKey's security score and audit history.
The details
CertiK, a blockchain security firm, examined UKey's firmware codebase and produced findings and recommendations. UKey's engineers fixed each finding in code, and those fixes were closed out through CertiK's review process. The firmware is published in a public repository so outside developers can read the code that controls key generation and transaction approval.
Timeline
UKey announced the CertiK-audited firmware release and Skynet monitoring on 2026-11-03.
The Tech Race
UKey's firmware audit places it among hardware wallet makers competing to offer verifiable, publicly reviewable security rather than trust-based claims. Its stated next steps, including client-side code publication and further reviews, indicate a phased approach to closing the gap between firmware and full-device transparency.
Users can check any UKey device's authenticity at ukey.com/hw-verify, and UKey products are available through JD.com. Client-side code publication and further independent reviews are planned, but no dates have been announced.
The takeaway
The firmware audit is the first phase of UKey's program, and UKey plans to disclose the scope and results of each completed phase. Watch for the client-side code publication and subsequent CertiK reviews, which will show whether hardware transparency follows the firmware work.
Further reading
For background on the cryptographic systems that hardware wallets depend on, see Quantum Computing.
More information
Verify your device's authenticity on the UKey device authenticity verification page.
Source note: This article includes information reported by The Manila times.
Live Poll
Would you trust a hardware wallet's security more after an independent audit?
