OneKey Drops CryptoBilis, Offers Free Wallet Replacements After Ledger Implant Find

Published October 12, 2026, 20:55 PKT. Based on OneKey’s October 12 statement and reporting by The Crypto Times, The Defiant, TradingKey and NS3.AI.

Hardware wallet maker OneKey has terminated CryptoBilis’s authorization as a OneKey reseller and will replace, free of charge, any OneKey device bought from the Southeast Asian reseller between March 1, 2026 and the date of its October 12 statement. The announcement, published on OneKey’s official blog and shared on X by the company’s founder Yishi Wang, comes days after Ledger confirmed that an unauthorized hardware implant had been found in devices sold through CryptoBilis. OneKey said it has received no reports of OneKey users losing assets in the incident, but that no reports do not mean no risk, adding that the company is not going to gamble with user security.

The three-step response

OneKey outlined three actions. First, effective immediately, the company has stopped onboarding new resellers. Second, every existing reseller, including those that passed OneKey’s checks before, will be reviewed and vetted again. Resellers whose business entity cannot be verified, or whose ultimate beneficial owner is unclear, will lose authorization and be removed from OneKey’s website. OneKey said the reseller network will get much smaller, and that once the review is finished it will publish the complete list of authorized resellers, so anyone not on that list is no longer an authorized OneKey dealer. Third, CryptoBilis buyers get the free replacement program described above, covering any OneKey model, whether or not it has been activated or used.

Why March 1 is the cutoff

OneKey said it chose March 1, 2026 because a former co-founder of CryptoBilis has publicly said the company was acquired earlier this year and that management responsibilities were handed over in March. Starting the window on March 1 covers the entire handover month and every purchase after it. OneKey noted that the window is already longer than 180 days, saying it would rather cover too much than too little. The March cutoff matters because investigators are scrutinizing the reseller’s ownership change: company records cited by Crowdfund Insider indicate full ownership had passed by early August to an individual with a registered address in China’s Heilongjiang province, and a former co-founder confirmed the March sale while saying confidentiality restrictions limited further details. No public evidence has yet tied the ownership shift to the compromised devices, but OneKey is deliberately covering the entire period after the transition.

No losses reported, but move your assets now

OneKey was explicit that the replacement can wait but assets should not. Buyers who have not activated their device should not activate it and should apply for a replacement directly. Buyers already using a device that holds assets should treat their current recovery phrase as possibly compromised and move their funds to a wallet with a brand-new recovery phrase as soon as possible, without waiting for the new device. OneKey said users with another hardware wallet from a trusted source should generate a fresh phrase on that device, while users without one should create a new wallet in the OneKey App on a trusted phone or computer as a temporary measure. When the replacement arrives, owners must generate a brand-new recovery phrase on it and must not import the old phrase or the temporary app wallet’s phrase. OneKey Support will never ask for a recovery phrase or PIN, the company warned, and anyone who does so in the name of a replacement or verification is a scammer.

The $90 million implant backdrop

The OneKey move widens the industry fallout from the CryptoBilis case. Ledger initially asked customers who bought devices from the reseller within the past 90 days not to set them up, then confirmed the unauthorized implant, while CryptoBilis has since stopped selling hardware wallets. Security analysts have estimated roughly 300 Ledger wallets were drained, with losses estimated between $86 million and $93 million, according to TradingKey and Crowdfund Insider, concentrated among buyers in Indonesia, Malaysia and the Philippines. CryptoBilis lists itself as an authorized reseller of Ledger, Trezor, OneKey, Tangem, SafePal, imKey and others across those three markets, which is why OneKey’s Yishi Wang posted on X that his company had terminated CryptoBilis’s authorization and detailed the three-step response. The Defiant reported that all OneKey models bought from the reseller between March 1 and October 12 qualify for the replacement, including used devices. For context, OneKey’s only publicly reported hardware flaw was a 2023 lab attack by security firm Unciphered that extracted a device’s seed; OneKey patched the gap, paid a bounty and said no users were affected.

How to claim a free replacement

Eligible buyers should go to the OneKey website, click the support button in the bottom-right corner, and state they are applying for the CryptoBilis replacement, providing proof of purchase, the device model, and whether it has been activated or used. Proof of purchase is required. The application deadline is December 31, 2026. Replacements ship directly from the official OneKey store, owners do not need to send the old device back, and if the original model is out of stock OneKey will upgrade to a newer model at no cost.

This article is news reporting and is not investment advice.

Sources

• OneKey’s official statement, primary source for the October 12 announcement: CryptoBilis’s authorization terminated, new reseller onboarding halted, full re-review of existing resellers, the March 1, 2026 to October 12, 2026 free replacement window, no OneKey user loss reports, the move-assets guidance, and the December 31, 2026 claim deadline
• The Crypto Times, secondary source for the October 12 announcement details, the Yishi Wang X post, and the no-loss-reports statement
• The Defiant, secondary source confirming that all OneKey models bought from CryptoBilis between March 1 and October 12 qualify, including used devices, with applications open through December 31
• TradingKey, secondary source for the three-step response breakdown, the March ownership-handover rationale, the roughly 300 drained wallets and $86 million to $93 million loss estimates, and the 2023 Unciphered lab incident
• NS3.AI via Binance Square, secondary source corroborating the authorization termination, the free replacement window, and the Yishi Wang guidance to move assets to new seed phrases without waiting
• Crowdfund Insider, secondary source for the CryptoBilis ownership records, the March acquisition confirmation from a former co-founder, and the $90 million drain estimates