OneKey founder and CEO Yishi Wang has announced that the hardware wallet maker's “dealer network will shrink significantly” after a full review of previously certified dealers, with those that have “unverifiable operating entities or unclear ultimate beneficiaries” set to have their authorization revoked and be removed from the official website. Wang also confirmed that OneKey has revoked CryptoBilis's authorization as a dealer for its devices.

The announcement follows reports that one of the Ledger wallets sold by Southeast Asian reseller CryptoBilis contained an unauthorized hardware implant, as the inquiry continues into a crypto theft with losses now estimated between $86 million and $93 million. The episode highlights the reseller layer of the hardware wallet business, in which devices pass through intermediaries between the manufacturer and the end user.

What has Ledger said about the CryptoBilis wallet hack?

An October 10 update shared on Ledger's support page confirmed that, pending the conclusion of its investigation, CryptoBilis will not sell any products from the hardware wallet maker. That statement came after Ledger, in a public statement on X, said that at least “one of the impacted users' devices contained an unauthorized hardware implant.”

Ledger stressed that its own systems and direct sales channels were untouched, pointing out that all of the exposed devices traced back to CryptoBilis. The distinction between reseller-sourced units and devices shipped directly by the manufacturer is the basis for the customer guidance that followed.

Ledger is advising anyone who bought wallets from the Southeast Asian reseller not to initialize any devices they have not yet set up. Customers who have already set up devices purchased from CryptoBilis are advised to transfer their funds to wallets issued directly by Ledger rather than through resellers.

So far, security analysts estimate that about 300 Ledger wallets have been drained of roughly $86 million to $93 million.

Why OneKey and SafePal buyers are nervous

While Ledger wallets are the only ones with reported thefts so far, the security scare has spread to customers of other wallet makers. CryptoBilis lists itself as an authorized reseller of Ledger, Trezor, OneKey, Tangem, SafePal, imKey and other wallets in Malaysia, and also operates in Indonesia and the Philippines.

In a post on X, Yishi Wang moved to calm the panic, writing: “We have terminated CryptoBilis's authorization; it is no longer an authorized OneKey dealer.”

Wang also detailed OneKey's three-step response to mitigate exposure now and prevent further escalation.

Step one: OneKey has stopped adding new dealers, effective as of the October 12 statement.

Step two: all existing dealers, including previously certified ones, will go through a fresh review process. Dealers with “unverifiable operating entities or unclear ultimate beneficiaries” will lose their authorization, and OneKey will publish the full list of authorized dealers on its official website.

Step three: users who bought OneKey devices from CryptoBilis between March 1, 2026, and October 12 are eligible for a free replacement. Even users who have already activated or used their devices can still receive one.

According to Wang, OneKey chose the March 1 cutoff date because CryptoBilis's original co-founder publicly stated that the company completed its operational management handover in March, after it was acquired earlier this year. Once the full dealer list is live on the official website, it will serve as the reference for buyers to check whether a seller is currently authorized.

OneKey's only previously reported hardware flaw dates back to 2023, when security firm Unciphered extracted a device's seed in a lab attack. OneKey patched the vulnerability, paid a bounty and said no users were affected.

Who owns CryptoBilis now?

Fresh corporate records point to a change of control at the Malaysian reseller before the suspected supply-chain attack. CryptoBilis's former co-founders said on LinkedIn that they handed the company to new owners in March, with reports claiming that ownership passed to an individual identified as Jiaming, a Chinese national.

There are no confirmed reports linking the new ownership with the security.

So far in 2026, six hardware wallet brands have disclosed security problems. Galaxy Research put losses above $115 million in the Coldcard case, and the early-October Ledger disclosure marks the second incident in which funds were lost. Cryptopolitan also reported the BasedApp breach that exposed customer KYC records last week.