OneKey drops CryptoBilis and offers replacements after $86 million Ledger wallet incident

Hardware wallet maker OneKey revoked CryptoBilis’s reseller authorization and offered free replacements to eligible customers after reports of stolen funds involving Ledger devices purchased through the same distributor.

So far, no OneKey user has reported losing funds in connection with the CryptoBilis incident. As a precaution, we've ended CryptoBilis's authorization and are taking three steps, effective today:

1. No new resellers.
2. A full review of every existing reseller. Any we can't… https://t.co/Hh34KhYnoj

— OneKey (@OneKeyHQ) October 12, 2026

OneKey CEO Yishi Wang said Monday that the company had received no reports of its users losing funds in connection with the incident. It nevertheless suspended new reseller approvals and began reviewing every existing dealer.

“But no reports don’t mean no risk,” Wang said. “Users’ asset security can’t rely on luck.”

The measures follow Ledger’s investigation into fund losses reported by customers in Southeast Asia who bought devices through CryptoBilis.

Blockchain investigator Specter estimated the losses at more than $86 million, though Ledger has not confirmed the total. On October 10, Ledger confirmed that one affected device contained an unauthorized hardware implant.

In an October 11 update, Ledger said all confirmed cases involved devices sold through CryptoBilis and that its internal systems and direct sales channels remained unaffected.

CryptoBilis also sold OneKey, Trezor, Tangem, SafePal and imKey products, prompting questions from customers about whether other devices could be at risk.

Wang said OneKey would revoke authorization for any reseller whose operating entity could not be verified or whose ultimate beneficial ownership remained unclear. He expects the dealer network to shrink significantly. The company plans to publish a complete list of authorized resellers once the review is finished.

The replacement program covers all OneKey models purchased from CryptoBilis between March 1 and October 12, 2026, whether activated, used or still unopened. Customers have until December 31 to apply.

Wang said the March cutoff reflects a former CryptoBilis cofounder’s public statement that the business changed ownership earlier this year and completed its operational handover in March.

That explanation does not establish a connection between the ownership change and the reported thefts.

Replacement devices will ship directly from OneKey’s official store. Customers will receive the same model or a free upgrade if it is unavailable, without having to return the original device.

Applications must be submitted through OneKey Support with the title “CryptoBilis Replacement.” Customers must provide proof of purchase, the device model and whether it has been activated or used.

Wang urged customers with unused devices to leave them unactivated. Those already holding assets should treat their existing recovery phrase as potentially compromised and move funds to a wallet with a newly generated phrase rather than wait for a replacement.

He also warned against importing the old recovery phrase into the replacement device. OneKey support will never request a recovery phrase or PIN, he said.