OneKey has revoked CryptoBilis’s authorization to sell its hardware wallets and will replace, for free, any OneKey device bought from the reseller since March 1. The company says none of its users has reported losing funds in the incident.
The move follows Ledger’s confirmation that a device it sold through CryptoBilis contained an unauthorized hardware implant, after wallets bought from the Southeast Asian reseller were drained on October 9. CryptoBilis also sold at least a dozen other wallet brands, and most of their makers have not said publicly whether their devices are affected.
OneKey announced the steps on October 12 in a statement on its blog, which was also posted on X by Yishi, who leads the company. A hardware wallet is a physical device that stores the private keys controlling a user’s crypto, kept offline away from internet-connected computers.
What Ledger Confirmed
On October 10, Ledger Support said that one affected user’s device contained an unauthorized hardware implant. Ledger said all confirmed cases from the October 9 draining incident involve devices sold through CryptoBilis. It said it had no indication that its own security infrastructure, systems, or services had been compromised.
Ledger said CryptoBilis has suspended sales of all its hardware wallet inventory while the investigation continues. Ledger said it is working with authorities and with SEAL 911, a volunteer group that responds to crypto security incidents.
Ledger advised customers who bought from CryptoBilis in the past 90 days not to initialize unused devices. It told customers who had already set up their devices to move their funds to a new recovery phrase on a device bought directly from Ledger.
Ledger has not published a figure for total losses. The Crypto Times reported that about $93 million was stolen from affected wallets, based on on-chain estimates.
What OneKey Is Doing
OneKey said it has stopped adding resellers and will re-review every existing one. It said it will revoke the authorization of any reseller whose business entity it cannot verify or whose ultimate beneficial owner is unclear. The company said its reseller network will shrink significantly and that it will publish a full list of authorized resellers once the review is complete.
The free replacement covers any OneKey model bought from CryptoBilis between March 1, 2026, and October 12, whether or not the device was activated or used. Buyers keep their old device. If the original model is out of stock, OneKey will send a newer model instead.
OneKey said it chose March 1 because a former CryptoBilis co-founder has said publicly that the company was acquired earlier this year, with management handed over in March. OneKey said the window is longer than 180 days. Ledger’s warning covers purchases from the past 90 days. Binance co-founder Changpeng Zhao has since said hackers bought the reseller.
How to Apply and What OneKey Advises
Buyers apply through the support button on OneKey’s website, with proof of purchase, the device model, and whether it has been activated or used. Applications close December 31, 2026.
OneKey advised buyers not to activate an unused device. For devices already holding funds, it said to treat the recovery phrase as possibly compromised and move the assets to a brand-new recovery phrase right away, without waiting for the replacement. It said OneKey Support will never ask for a recovery phrase or PIN.
Other Brands CryptoBilis Sold
CryptoBilis’s own product pages describe it as an authorized reseller for Ledger, Trezor, Tangem, OneKey, CoolWallet, SafePal, Ellipal, BitBox, D’Cent, Ballet, SecuX, Satochip, imKey, and UKISS. It sold them in Malaysia, the Philippines, and Indonesia.
Also Read: Coldcard Hack Stirs Dormant Bitcoin, Retail Transfers Hit FTX-Era Highs
