1. What did OneKey announce about CryptoBilis?
Hardware wallet maker OneKey on October 12 revoked the reseller authorization of CryptoBilis, a Southeast Asian distributor, and offered free replacement devices to eligible customers. The company also froze approvals of new resellers and began reviewing every existing one. The moves follow Ledger's investigation into fund losses on devices sold through the same distributor, and OneKey says no user of its own has reported losing money.
In a post on its official account, OneKey said it was ending CryptoBilis's authorization as a precaution and listed measures taking effect the same day: no new resellers, and a full review of the current network. Chief executive Yishi Wang said the company had received no reports of user losses tied to the incident, yet had chosen to act anyway.
Wang's reasoning was blunt. The absence of reports, he said, does not mean there is no risk, and the security of user assets should not depend on luck. The announcement therefore treats the situation as a supply-chain precaution rather than as a response to a confirmed OneKey breach.
2. Why is the CryptoBilis incident a problem for wallet makers?
The episode began with Ledger's investigation into fund losses reported by customers in Southeast Asia who had bought devices through CryptoBilis. On October 10, Ledger confirmed that one affected device contained an unauthorized hardware implant, a physical modification that should not exist in a genuine product. In an update on October 11, Ledger said every confirmed case involved devices sold through CryptoBilis, and that its internal systems and direct sales channels were not affected.
That finding shifts attention from the device maker to the path the device took before reaching the customer. A hardware wallet is designed so that private keys never leave the device, and its security depends on the device being exactly what the manufacturer shipped. If a product is opened and altered between the factory and the buyer, the protections built into the design can be bypassed without any flaw in the manufacturer's own code or infrastructure.
The size of the losses has been stated differently by different observers, and Ledger has not confirmed a total. What is established is the mechanism Ledger has described for one device, and the fact that every confirmed case it has seen traces back to a single reseller.
3. How do supply-chain attacks on hardware wallets work?
A hardware wallet is a small device that stores the private keys controlling a person's crypto and signs transactions internally, so the keys are never exposed to a connected computer. That design protects against malware on the user's laptop or phone. It assumes, however, that the device itself has not been altered and that the secure chip inside does what the manufacturer intended.
A supply-chain attack targets the stage before the customer takes possession. An attacker who can intercept, open or modify devices in transit, or who controls the seller, may insert components or change behavior so that secrets can later be read or leaked. Because the device looks and often functions normally, the buyer has little reason to suspect a problem until funds are moved.
Standard defenses include buying directly from the manufacturer or a verified reseller, checking packaging and tamper evidence, and generating a recovery phrase on the device only after confirming it is genuine. The CryptoBilis case is a reminder that these precautions matter most when a device arrives through a channel the buyer cannot easily verify.
Hardware wallet makers generally recommend that users keep the recovery phrase offline and never type it into a website or share it with anyone. Those habits protect users against the most common scams, but they cannot fully protect someone whose device was compromised before first use, which is why the replacement and migration steps described here go further than usual advice.
4. Which other wallet brands did CryptoBilis sell?
CryptoBilis did not sell only Ledger products. It also distributed devices from OneKey, Trezor, Tangem, SafePal and imKey. That range is the reason the story has spread beyond one manufacturer, and it raised questions among customers about whether devices from the other brands could also be exposed.
OneKey's response is the first of its kind among those names to come with concrete remedies. The company has not said that any of its devices were tampered with. Its position is that, until the facts are fully known, customers who bought through this channel should be offered a clean replacement and clear instructions.
For buyers of any hardware wallet, the episode illustrates a general point: the reseller is part of the security model. A device bought from an unverified third party can carry risks that a device bought from the manufacturer's own store does not.
5. How does OneKey's replacement program work?
The program covers all OneKey models bought from CryptoBilis between March 1 and October 12, 2026. It applies whether the device has been activated, used or left unopened. Applications are due by December 31.
Replacements ship directly from OneKey's official store. A customer receives the same model, or a free upgrade if that model is unavailable, and does not have to return the original device. Requests go through OneKey Support under the title "CryptoBilis Replacement." Applicants must provide proof of purchase, the device model, and whether the device has been activated or used.
The decision to let customers keep the original unit is notable. Returning a suspect device would give the manufacturer a chance to examine it, but it would also require customers to hand over hardware that may have held their recovery phrase. OneKey instead puts the priority on getting a trustworthy device into customers' hands.
6. Why does the replacement window start on March 1?
Wang said the March 1 cutoff reflects a public statement by a former CryptoBilis cofounder. According to that statement, the business changed ownership earlier in 2026 and completed its operational handover in March. OneKey chose the date as a conservative boundary for the period in which control of the business may have changed.
It is important to read this carefully. The ownership change and the reported thefts have not been shown to be connected, and the explanation from the former cofounder does not establish any link between the two. The date is a practical way to define which purchases receive replacements, not a finding about what happened.
By choosing a start date tied to a change of control rather than to a confirmed tampering event, OneKey has widened the group of eligible customers to include anyone who might have bought from the distributor under its new management.
7. What should customers with OneKey devices from CryptoBilis do?
Wang offered specific guidance. Customers who hold an unused device should leave it unactivated. Those who already store assets on a device bought through CryptoBilis should treat the existing recovery phrase as potentially compromised and move their funds to a wallet with a newly generated phrase, rather than waiting for a replacement to arrive.
He also advised against importing the old recovery phrase into the replacement device, which would defeat the purpose of the swap. A recovery phrase is the master record of a wallet; anyone who has it can control the funds. If the original device could have exposed it, the safe course is to create a fresh one on trusted hardware and transfer the assets.
Wang added that OneKey support will never ask a customer for a recovery phrase or a PIN. That reminder matters because incidents of this kind often attract impersonators who contact worried users and offer help in exchange for those very details.
8. How will OneKey change its reseller network?
Under the review, OneKey will revoke the authorization of any reseller whose operating entity cannot be verified or whose ultimate beneficial ownership is unclear. Wang expects the dealer network to shrink significantly as a result. When the review ends, the company plans to publish a full list of authorized resellers.
A public list gives customers a way to check a seller before purchase. For a product whose value depends on its integrity, the ability to confirm that a distributor is genuine is a basic safeguard. It also puts pressure on any remaining resellers to demonstrate transparency about who owns and operates them.
The tradeoff is reach. Resellers help hardware wallet makers sell in regions where direct shipping is slow or costly. A smaller network may mean fewer local points of sale, though OneKey's official store remains available as the direct channel.
9. What happens next?
Several developments are worth watching. The first is Ledger's continuing investigation, which could clarify how the implanted hardware reached customers and how many devices are affected. The second is whether other brands sold by CryptoBilis, namely Trezor, Tangem, SafePal and imKey, announce their own measures. The third is the conclusion of OneKey's reseller review and the publication of its authorized list.
For customers, the nearest deadline is December 31, the last day to apply for a replacement. Anyone who bought a OneKey device from CryptoBilis between March 1 and October 12 should submit proof of purchase through OneKey Support before then, and should move any funds off the old device to a freshly generated wallet in the meantime.
The broader lesson for the hardware wallet industry is that the chain of custody from factory to buyer is part of the product. Manufacturers have limited visibility once devices pass through third parties, and this case is likely to push the sector toward tighter vetting of the businesses that sell its devices.