OneKey revokes reseller CryptoBilis and will replace any OneKey device bought there since March 1
OneKey has revoked reseller CryptoBilis and will replace for free every OneKey wallet bought there since March 1. Ledger confirmed an implant in one device from that reseller. Most makers of the other brands it sold have not said whether they are affected.
The Scientist · Science desk
Three figures: OneKey's window is 225 days; Ledger's warning covers purchases from the past 90 days; CryptoBilis's product pages list 12 other brands besides Ledger and OneKey.
| Figure | Value | Note | Claim |
|---|---|---|---|
| OneKey's window | 225 days | 16 | |
| Ledger's warning period | 90 days | 10 | |
| Listed by CryptoBilis | 12 other brands | 17 |
What happened
- Wallets bought from the Southeast Asian reseller were drained on October 9, and Ledger said every confirmed case from that incident involves a device sold through CryptoBilis.
- Ledger said CryptoBilis has suspended sales of all its hardware wallet inventory and is cooperating with authorities and with SEAL 911, a volunteer crypto incident-response group.
- The OneKey replacement covers any model whether or not it was activated or used, buyers keep the old device, and applications close on December 31, 2026.
- OneKey has stopped adding resellers and will revoke any existing one whose business entity it cannot verify or whose ultimate beneficial owner is unclear.
Why it matters
- Who's exposed exposure Owners of the 12 other brands CryptoBilis listed bought through the same channel as the affected buyers, and most of their makers have not said whether the devices are safe.
- Who has to decide decision Other makers now have to pick a lookback. Ledger's covers 90 days and OneKey's 225, so a CryptoBilis buyer in the gap between them gets different advice depending on the brand.
- What it sets up precedent OneKey's test of a verifiable entity and a known beneficial owner gives other makers a standard to check their own reseller lists against, and OneKey expects its network to shrink significantly.
Next story · Invest · yesterday
Bitquery counts $102 million drained from 324 Ledger-linked wallets across six chainsConfirmed6 publishers
The implant finding and the loss figure measure different things. The finding is a hardware result from one user's device [3]. The roughly $93 million is The Crypto Times' on-chain estimate of stolen funds, and Ledger has not published a total [18]. Neither says how many of the reseller's units were tampered with. That count is the denominator a buyer needs.
OneKey's offer is therefore a precaution. The company says none of its users has reported losing funds [2]. The thing this doesn't tell you is whether any OneKey unit has been opened, or when the implanted Ledger unit was sold.
That second gap matters because the two makers drew their cutoffs differently. OneKey chose March 1 on the strength of public remarks by a former CryptoBilis co-founder, who said the company was bought earlier this year and changed management in March [8]. Changpeng Zhao, the Binance co-founder, has since said hackers bought the reseller [19]. OneKey calls its window longer than 180 days [9]. Counted from March 1 to October 12, it is 225 days [15]. Ledger's warning covers purchases from the past 90 days [10], so OneKey reaches back about 2.5 times as far [16].
The advice for funded devices is close to identical. Ledger told customers who had already set up their devices to move funds to a new recovery phrase on a device bought directly from Ledger [10]. OneKey said to treat the recovery phrase as possibly compromised and move assets to a brand-new phrase right away, without waiting for the replacement [11].
CryptoBilis's product pages list 14 brands [13]. That leaves 12 besides Ledger and OneKey [17], and most of those makers have not said whether their devices are affected [14]. In our view the reseller is the variable to test first, because every confirmed case runs through it [4]. Ledger also said it had seen no sign that its own systems, services or security infrastructure were breached [5]. The view holds only if the implant went in at or after the reseller.
What to watch
- Statements from the makers of the 12 other listed brands on whether any CryptoBilis units were tampered with.
- Whether Ledger publishes when the implanted unit was sold and a total loss figure, which would test the 90-day and 225-day cutoffs.
- OneKey's full list of authorized resellers once its review is complete.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+10
- Incentives50
- Confidence62
Perspective Coverage
3 publishers- Builder
- Builder 30%
- Operator
- Operator 45%
- Investor
- Investor 25%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
OneKey has revoked CryptoBilis's authorization to sell its hardware wallets and will replace, for free, any OneKey device bought from the reseller since March 1.
- [2]
OneKey says none of its users has reported losing funds in the incident.
- [3]
On October 10, Ledger Support said that one affected user's device contained an unauthorized hardware implant.
- [4]
Wallets bought from the Southeast Asian reseller were drained on October 9, and Ledger said all confirmed cases from that draining incident involve devices sold through CryptoBilis.
- [5]
Ledger said it had no indication that its own security infrastructure, systems, or services had been compromised.
- [6]
Ledger said CryptoBilis has suspended sales of all its hardware wallet inventory while the investigation continues, and that it is working with authorities and with SEAL 911, a volunteer group that responds to crypto security incidents.
- [7]
OneKey's free replacement covers any OneKey model bought from CryptoBilis between March 1, 2026, and October 12, whether or not the device was activated or used; buyers keep their old device and applications close December 31, 2026.
- [8]
OneKey said it chose March 1 because a former CryptoBilis co-founder has said publicly that the company was acquired earlier this year, with management handed over in March.
- [9]
OneKey said its replacement window is longer than 180 days.
- [10]
Ledger's warning covers purchases from the past 90 days: it advised customers who bought from CryptoBilis in that period not to initialize unused devices, and told customers who had already set up their devices to move their funds to a new recovery phrase on a device bought directly from Ledger.
- [11]
For devices already holding funds, OneKey said to treat the recovery phrase as possibly compromised and move the assets to a brand-new recovery phrase right away, without waiting for the replacement.
- [12]
OneKey said it has stopped adding resellers and will re-review every existing one, revoking the authorization of any reseller whose business entity it cannot verify or whose ultimate beneficial owner is unclear; it said its reseller network will shrink significantly and that it will publish a full list of authorized resellers once the review is complete.
- [13]
CryptoBilis's own product pages describe it as an authorized reseller for Ledger, Trezor, Tangem, OneKey, CoolWallet, SafePal, Ellipal, BitBox, D'Cent, Ballet, SecuX, Satochip, imKey, and UKISS, sold in Malaysia, the Philippines, and Indonesia.
- [14]
CryptoBilis also sold at least a dozen other wallet brands, and most of their makers have not said publicly whether their devices are affected.
- [15]
March 1 to October 12, 2026 is 225 days.
- [16]
OneKey's 225-day window is 2.5 times Ledger's 90-day warning period.
- [17]
Besides Ledger and OneKey, CryptoBilis's product pages list 12 other brands.
- [18]
Ledger has not published a figure for total losses; The Crypto Times reported that about $93 million was stolen from affected wallets, based on on-chain estimates.
- [19]
Binance co-founder Changpeng Zhao has since said hackers bought the reseller.
Sources
3 independent publishers whose own reporting we read for this story.
- cryptobriefing.comOneKey drops CryptoBilis and offers replacements after $86 million Ledger wallet incident
1 article · October 12, 2026
- cryptopolitan.comLedger confirms CryptoBilis implant; other wallet buyers seek answers
1 article · October 12, 2026
- cryptotimes.ioOneKey Drops CryptoBilis, Replaces Wallets Sold Since March 1 After Ledger Implant Find
1 article · October 12, 2026
Topics and entities
Topics
- Reseller authorization
- Crypto supply chain attacks
- Hardware Wallet Security