OneKey founder and CEO Yishi Wang said the hardware wallet maker has terminated CryptoBilis's dealer authorization and will shrink its reseller network worldwide, as fallout from the suspected supply-chain attack on Ledger devices sold by the Malaysian reseller continues to spread.

"We have terminated CryptoBilis's authorization; it is no longer an authorized OneKey dealer," Wang wrote in a statement detailing a three-step response, reported by Cryptopolitan. The move matters beyond OneKey's own customers: CryptoBilis listed itself as an authorized reseller not only for Ledger and OneKey but also Trezor, Tangem, SafePal and imKey, operating in Malaysia, Indonesia and the Philippines — putting every brand it carried under new scrutiny.

OneKey's three-step response

  • Dealer freeze: OneKey has stopped onboarding new dealers, effective October 12.
  • Full re-review: All existing dealers, including previously certified ones, face a fresh vetting process. Dealers with "unverifiable operating entities or unclear ultimate beneficiaries will have their authorization revoked and be removed from the official website," Wang said, adding that the dealer network "will shrink significantly." OneKey will publish the full list of authorized dealers on its official website.
  • Free replacements: Users who bought OneKey devices from CryptoBilis between March 1, 2026 and October 12 are eligible for a free replacement — including devices that have already been activated and used.

The March 1 cutoff was chosen deliberately. According to Wang, CryptoBilis's original co-founder publicly stated that the company completed an operational management handover in March, after being acquired earlier this year. Corporate records and LinkedIn statements by the former co-founders point to a change of control at the reseller before the draining incident began; reports claim ownership passed to an individual identified as Jiaming, a Chinese national. There are no confirmed reports linking the new ownership to the security incident, and no perpetrator has been identified — the tampering remains a suspected supply-chain attack under investigation.

What Ledger has confirmed

Ledger said on October 10 that at least one impacted user's device "contained an unauthorized hardware implant," and that pending the end of its investigation, CryptoBilis will not be selling Ledger products. The company reiterated that its own systems and direct sales channels were untouched, and that all confirmed cases to date involve devices sold through CryptoBilis — a position repeated across coverage by The Hacker News, Help Net Security and PC Gamer.

Ledger's guidance to buyers: do not initialize any device purchased from the reseller that has not yet been set up, and move funds from already-configured reseller-bought devices to a wallet purchased directly from Ledger or another official channel.

Security analysts estimate roughly 300 Ledger wallets have been drained of between $86 million and $93 million across Bitcoin, Ethereum and Tron, according to the Cryptopolitan report — figures attributed to on-chain researchers, not confirmed by Ledger itself.

A bruising year for hardware wallets

The case is the second this year in which hardware wallet users lost funds outright. At least six hardware wallet brands have disclosed security problems in 2026, and Galaxy Research put losses in the Coldcard seed-generation case above $115 million. OneKey's own only publicly disclosed hardware flaw remains a 2023 lab attack by security firm Unciphered, which OneKey patched and bountied with no users affected.

The industry-wide lesson now being priced in: the security of a hardware wallet is only as strong as the chain of custody that delivered it. Buying direct from the manufacturer has moved from best practice to baseline defense — and reseller vetting, long an afterthought, is suddenly a board-level topic for every wallet maker.

TrustGrade's previous coverage: Ledger reseller suspected in $86M wallet drain, Ledger confirms hardware implant and the attacker's laundering trail.

TrustGrade tracks the security posture of platforms and protocols in digital assets. Verified trust data: trustgrade.ai.