OneKey cuts CryptoBilis as fallout from $86M Ledger wallet exploit spreads

OneKey Founder and CEO Yishi Wang has announced that the hardware wallet maker’s “dealer network will shrink significantly,” after a full review of previously certified dealers, while those with “unverifiable operating entities or unclear ultimate beneficiaries will have their authorization revoked and be removed from the official website.”

Yishi also said OneKey has revoked CryptoBilis’s authorization as a dealer for its devices. 

That warning lands after one of the Ledger wallets sold by Southeast Asian reseller CryptoBilis was reported to have contained an unauthorized hardware implant, as the inquiry continues into a crypto theft with losses now estimated between $86 million and $93 million.

What has Ledger said about the CryptoBilis wallet hack?

An October 10 update shared on Ledger’s support page confirmed that pending the end of its investigation, CryptoBilis will not be selling anything from the hardware wallet maker. That statement came after Ledger said that at least “one of the impacted users’ devices contained an unauthorized hardware implant.” 

Ledger stressed that its own systems and direct sales channels were untouched, pointing out that the exposed devices all traced back to CryptoBilis. 

Ledger is advising anyone who bought wallets from the Southeast Asian reseller not to initialize any devices they have not set up yet. And for anyone who has already set them up, they are advised to transfer their funds to wallets issued directly by Ledger, not bought from resellers.

So far, security analysts have estimated that about 300 Ledger wallets have been drained of an estimated $86 million to $93 million. 

Why OneKey and SafePal buyers are nervous

While Ledger wallets have been the only ones to report thefts so far, the security scare has spread to customers of other wallet makers. CryptoBilis lists itself as an authorized Ledger reseller of Ledger, Trezor, OneKey, Tangem, SafePal, imKey and other wallets in Malaysia, also operating in Indonesia and the Philippines. 

OneKey founder and CEO Yishi Wang moved to calm the panic on X, writing that “We have terminated CryptoBilis’s authorization; it is no longer an authorized OneKey dealer.”

Yishi also detailed OneKey’s three-step response to mitigate exposure now and prevent further escalation. 

• Step one: OneKey has stopped adding new dealers, effective as of the October 12 statement.
• Step two: All existing dealers, including previously certified ones, will go through a fresh review process. Dealers with “unverifiable operating entities or unclear ultimate beneficiaries” will lose their authorization. OneKey will publish the full list of authorized dealers on the official website.
• Step three: Users who bought OneKey devices from CryptoBilis between March 1, 2026, and October 12 are eligible for a free replacement. Even users who have activated or used their devices can still get a free replacement.

Per Yishi, OneKey went with the March 1 cutoff date because CryptoBilis’s original co-founder publicly stated that the company completed its operational management handover in March after it was acquired earlier this year.  

OneKey’s only publicly reported hardware flaw happened way back in 2023, when security firm Unciphered extracted a device’s seed in a lab attack. OneKey patched the gap, paid a bounty and said no users were affected.

Who owns CryptoBilis now?

Fresh corporate records point to a change of control at the Malaysian reseller before the suspected supply-chain attack. CryptoBilis’s former co-founders said on LinkedIn that they handed the company to new owners in March, with reports claiming that ownership passed to an individual identified as Jiaming, a Chinese national. 

There are no confirmed reports linking the new ownership with this security incident. 

So far in 2026, six hardware wallet brands have disclosed security problems. Galaxy Research put losses above $115 million in the Coldcard case. This early October Ledger disclosure is the second case where funds were lost. 

Cryptopolitan reported the BasedApp breach that exposed customer KYC records last week.