OneKey's Response to the CryptoBilis Incident
Key Takeaways
• We have no reports of OneKey users losing assets in this incident, but we are acting as if the risk is real. CryptoBilis is no longer an authorized OneKey reseller.
• OneKey has stopped adding resellers and is re-reviewing every existing one. A full list of authorized resellers will be published on our website.
• OneKey devices bought from CryptoBilis from March 1, 2026 to the date of this statement can be replaced for free. Apply through the support button on the OneKey website by December 31, 2026.
• If your device holds assets, move them to a brand-new recovery phrase now. OneKey Support will never ask for your recovery phrase or PIN.
Over the past few days, several people who bought Ledger hardware wallets from CryptoBilis have reported that their assets were stolen. Ledger has confirmed that unauthorized hardware had been implanted in the affected devices. The cause and how far it spread are still under investigation.
CryptoBilis also sold OneKey, Trezor, Tangem, SafePal, imKey and other brands, so many of you have asked us the same question: is my OneKey still safe?
As of this writing, we have not received any report of a OneKey user losing assets in connection with this incident. But no reports does not mean no risk. Your security should not depend on luck, and we are not going to gamble with it.
We have terminated CryptoBilis's authorization. CryptoBilis is no longer an authorized OneKey reseller.
Starting today, we are doing three things.
1. No new resellers
Effective immediately, OneKey has stopped onboarding new resellers.
2. Every existing reseller will be re-reviewed
Resellers that passed our checks before will all be reviewed and vetted again. If we cannot verify a reseller's business entity, or its ultimate beneficial owner is unclear, its authorization will be revoked and it will be removed from our website.
Our reseller network will get much smaller. A hardware wallet protects people's assets, so the channels that sell it have to be held to a strict standard.
When the review is finished, we will publish the complete list of authorized resellers on the OneKey website. From then on, anyone not on that list is not an authorized OneKey reseller.
3. Free replacement for eligible CryptoBilis buyers
If you bought a OneKey hardware wallet from CryptoBilis between March 1, 2026 and the date this statement was published, you can get a free replacement. Any model qualifies, whether or not it has been activated or used.
Why March 1? A former co-founder of CryptoBilis has said publicly that the company was acquired earlier this year and that management responsibilities were handed over in March. Starting on March 1 covers the entire handover month and every purchase after it. That window is already longer than 180 days. We would rather cover too much than too little.
- Shipped by OneKey. Replacements ship directly from the official OneKey store.
- Same model, brand new. You get a new unit of the model you bought. If that model is out of stock, we will upgrade you to a newer model at no cost.
- No need to send anything back. Keep the old device. We will simply ship you a new one.
How to apply
Go to the OneKey website, click the support button in the bottom-right corner, and tell us you are applying for the CryptoBilis replacement. Please provide:
- Proof of purchase or receipt (required)
- Your device model
- Whether the device has been activated or used
Deadline: December 31, 2026.
Don't wait to protect your assets
The replacement can wait for you. Your assets should not wait for the replacement.
If your device has not been activated: don't activate it. Apply for a replacement directly.
If you are already using it and it holds assets: as a precaution, treat your current recovery phrase as possibly compromised. Move your assets to a wallet with a brand-new recovery phrase as soon as you can. Don't hold off while you wait for the new device.
- If you have another hardware wallet from a trusted source, generate a brand-new recovery phrase on that device and move your assets there.
- If you don't, create a new wallet in the OneKey App on a phone or computer you trust, generate a brand-new recovery phrase, and move your assets there as a temporary measure.
When your new device arrives, generate a brand-new recovery phrase on it, then move your assets onto it. Do not import the old recovery phrase into the new device, and do not import the temporary app wallet's recovery phrase either. Once everything has been moved, stop using the old device and the old recovery phrase.
One last reminder: OneKey Support will never ask for your recovery phrase or PIN. Anyone who asks for them in the name of a "replacement" or "verification" is a scammer.
Your trust is ours to keep
People choose OneKey because they trust OneKey. It is on us to live up to that.
FAQ's
As of this statement, OneKey has received no reports of OneKey users losing assets in connection with this incident. As a precaution, eligible buyers can get a free replacement, and anyone already holding assets on such a device should move them to a brand-new recovery phrase.
Anyone who bought a OneKey hardware wallet of any model from CryptoBilis between March 1, 2026 and the date this statement was published, whether or not it was activated or used. Proof of purchase is required.
Click the support button in the bottom-right corner of the OneKey website, say you are applying for the CryptoBilis replacement, and provide your proof of purchase, device model, and whether the device has been activated or used. The deadline is December 31, 2026.
No. OneKey ships a new device of the same model directly from the official store. If that model is out of stock, you get a free upgrade to a newer model.
Never. OneKey Support will never ask for your recovery phrase or PIN. Anyone asking for them in the name of a replacement or verification is a scammer.
