OneKey has cut off CryptoBilis and offered free replacement wallets as the Ledger theft scare pushes beyond one manufacturer's customers. The decision expands the fallout across the reseller's hardware-wallet business, while a newly revised tracing estimate puts losses above the $100 million mark.
The company says it has received no reports of OneKey users losing assets in this incident. Its response is precautionary, not confirmation that its wallets were compromised. Meanwhile, Ledger has released a fresh explanation of how a hidden implant stole recovery words.
OneKey shuts the reseller door
In its October 12 statement, the wallet maker revoked CryptoBilis's authorization, stopped onboarding new resellers and ordered a review of every existing partner. Sellers whose business entity or ultimate beneficial owner cannot be verified will lose authorization.
As of this writing, we have not received any report of a OneKey user losing assets in connection with this incident. But no reports does not mean no risk.
The company expects its reseller network to shrink substantially. Once the review is complete, it will publish a full authorized-seller list, making that list the reference for buyers checking a retailer's status.
Its replacement offer covers any OneKey model bought from CryptoBilis between March 1 and October 12, whether activated or unused. Applications require purchase proof, the model and activation status, and must be submitted through its official website's support button by December 31.
New units ship directly from the official store. Customers keep the old device, and unavailable models receive a free upgrade. Buyers already holding assets are told to move them to a wallet with a new recovery phrase without waiting for the replacement.
As previously reported by Apex, the investigation began with CryptoBilis-sold Ledger devices and a confirmed hardware implant in one affected unit. The retailer suspended hardware-wallet sales across all brands in Malaysia, Indonesia and the Philippines.
Ledger explains the implant
The October 13 update describes an implant inside the enclosure that reads the screen during setup. Its microcontroller decodes the displayed recovery words and sends them over LTE through a provisioned eSIM. The component does not modify the Secure Element or operating system, or alter transactions and signatures.
All confirmed fund losses tied to the incident disclosed on October 9th involve signers sold through CryptoBilis. We have not verified a drain linked to a signer bought elsewhere.
The manufacturer has not confirmed the total number of victims or value lost and says circulating figures remain third-party estimates. Reports involving other devices and locations are still being reviewed.
The loss estimate keeps rising
Bitquery's October 12 revision estimates $102 million taken from 324 wallets across six blockchains, including Bitcoin and Ethereum. Investigators identified nine additional wallets drained of $8.8 million on October 9. That raises the earlier $93.2 million estimate; it is not evidence of $8.8 million newly stolen on October 12. Wallets also do not equal individual people.
Apex had earlier reported $5.35 million in potentially freezable stablecoins. Those wallets were emptied before intervention; researchers now identify $2.38 million in two likely attacker wallets still eligible for freezing.
The distinction now matters for customers of every brand the reseller carried. A replacement offer addresses device risk, not reimbursement for stolen crypto. Anyone with an unused suspect device should leave it uninitialized. Existing users need fresh recovery words, not the same phrase restored onto new hardware. Official support will never need those words or a PIN to process a replacement.