How to Prevent Supply Chain Attacks on Hardware Wallets

The imKey Pro hardware wallet uses a security chip manufactured by Infineon (model: SLE78CLUFX5000PH). This chip meets the military-grade CC EAL 6+ standard, which is recognized as the highest security level for hardware wallets equipped with secure chips. As one of the most secure solutions for safeguarding digital assets, hardware wallets can protect sensitive information, such as private keys, from unauthorized access or tampering by hackers, ensuring better asset security. However, no system is entirely immune to risks. For hardware wallets, supply chain vulnerabilities remain a critical challenge.

This article introduces the measures imKey Pro has implemented to address supply chain attacks, focusing on two key aspects: purchase channels and product unboxing.

How to Purchase imKey Pro

To ensure product quality and after-sales service, we strongly recommend purchasing through official channels. Currently, imKey offers three purchasing options:

1. Youzan Store
   If your delivery address is within China, you can purchase via the official Youzan store. Products are shipped domestically via SF Express, which is fast, secure, and reliable.
   
   
2. Amazon Store
   For customers outside China, the official imKey Amazon store is a convenient option. Amazon, a globally trusted e-commerce platform, ensures a smooth purchase and delivery process.
   
   
3. Official Website
   Alternatively, overseas customers can buy directly from the official imKey website.
   
   

Important: Only products purchased through official channels are guaranteed to ensure the safety of your assets and qualify for official after-sales service. If you purchase from other channels, we cannot guarantee product quality or support.

How to Prevent Supply Chain Attacks on Hardware Wallets

Before unboxing your imKey Pro for the first time, follow these steps to verify it is an authentic product:

1. Check the Shipping Origin
   Ensure the shipping origin matches the official address. For China, the designated shipping location is Hangzhou, Zhejiang Province (specific details are available on the official website).
   
   
2. Inspect the Shipping Box
   Verify that the shipping box is the official customized packaging (with the imKey logo).

(Example of the medium-sized imKey logo packaging)

3. Inspect the Product’s Outer Packaging
   
   
   • Confirm that the plastic wrap on the product’s outer packaging is intact.
   • Ensure that the tamper-proof seals on both sides of the packaging are undamaged. When peeled off, the seals should reveal a pattern of complete letters.

4. Examine the Device Interface
   After powering on an unactivated device, the screen should display the following sequence: language selection → device Bluetooth name.

(This interface confirms the device has not been activated.)

5. Verify Device Activation
   During the initial setup with the imToken app, the hardware device will display a prompt indicating “Activation Successful.”

Note: If your imKey Pro fails any of the above checks, it is likely a used product. Using such a device may lead to asset loss. In such cases, contact us via Discord or email support@imkey.im for confirmation.

Important Reminders

When you receive a brand-new device, make sure to personally complete the following steps:

• Activate the device: Activation is irreversible and can only be done once per device.
• Set and back up your PIN code and binding code.
• Create and back up your mnemonic phrase.

Final Thoughts  

To quote the Blockchain Dark Forest Handbook, there are two key principles to follow:

1. Zero Trust: Always maintain skepticism, no matter the situation.
2. Continuous Verification: To trust, you must have the ability to verify your doubts and make this habit a part of your routine.

If you have any concerns, please reach out to us via Discord or email support@imkey.im . Let’s work together to safeguard your assets.