The fallout from the CryptoBilis hardware-wallet investigation widened on October 12 as OneKey revoked the Southeast Asian reseller’s authorized-dealer status, froze the addition of new resellers and offered free replacement devices to customers who bought its wallets through CryptoBilis.
The move is significant because OneKey says it has received no reports of its own customers losing assets through the incident. Rather than waiting for evidence of theft involving OneKey devices, the company is treating the distribution channel itself as potentially compromised.
At the same time, Ledger issued a new 72-hour update saying every confirmed case tied to the October 9 wallet-draining incident still involves devices sold through CryptoBilis. Ledger said its internal systems and direct-sales channels remain unaffected and described the number of impacted devices as limited.
A separate lead from SlowMist founder Cosine has also brought the Ledger Flex into the investigation. Cosine said one case strongly associated with the CryptoBilis investigation involves a Flex device, potentially widening researchers’ attention beyond the Ledger Nano X. Crucially, that does not establish that the Flex was tampered with or caused a theft.
OneKey Revokes CryptoBilis and Freezes New Dealer Appointments
OneKey’s response goes considerably further than simply removing CryptoBilis from a reseller list.
In its official response to the CryptoBilis incident, the company said it has stopped onboarding new resellers altogether and will re-review every existing authorized dealer. OneKey said partners that cannot satisfy renewed checks around the business entity or ultimate ownership could lose their authorization.
The company also plans to publish a complete authorized-reseller list once that review is completed.
For CryptoBilis customers, OneKey is offering free replacements for hardware wallets purchased between March 1, 2026 and the date of its October 12 statement. Any model qualifies whether it has been activated or used, although customers must provide proof of purchase. Applications remain open through December 31.
OneKey said replacement devices will ship directly from its official store. Buyers do not need to return the old device, and if the original model is unavailable, the company says it will provide a newer model without additional cost.
The March 1 cutoff is also revealing. OneKey said it selected that date after a former CryptoBilis co-founder publicly stated that the business had been acquired earlier this year and management responsibilities were transferred in March. That does not establish when or how any tampering occurred, but OneKey is deliberately covering the entire period following that transition.
OneKey Tells Existing Users to Abandon Their Old Seed Phrases
The more important part of OneKey’s response is what it is telling customers who already use CryptoBilis-supplied devices.
The company says users with assets on those wallets should treat the existing recovery phrase as potentially compromised and move their holdings to addresses generated from an entirely new seed.
That is essentially the same security logic already emerging from the initial Ledger-CryptoBilis investigation. Replacing a physical wallet while continuing to use an old seed does not solve the problem if an attacker may already possess that seed.
OneKey also says customers should not initialize unused devices purchased through CryptoBilis. Those already using one should generate an entirely new recovery phrase through a trusted device or, temporarily, a clean software wallet before moving assets.
Importantly, OneKey says it has not received any reports of its own customers losing funds in connection with CryptoBilis. Its replacement program is therefore precautionary rather than a response to confirmed OneKey thefts.
CryptoBilis has also sold hardware wallets from several other manufacturers, including Trezor, Tangem, SafePal and imKey. There is currently no evidence establishing that devices from those brands were tampered with.
Ledger Says Every Confirmed Theft Case Still Leads Back to CryptoBilis
Ledger’s 72-hour update provides a narrower picture of what the company considers confirmed.
According to Ledger, all confirmed cases related to the October 9 draining incident involve devices sold by CryptoBilis. The company says its own infrastructure and direct-sales channels were not compromised and that the volume of affected devices is limited, although it has not disclosed an exact number.
Ledger is contacting affected users, working with relevant authorities and reviewing its authorized-reseller controls. It has also reminded distributors not to return previously sold products to inventory and says it is strengthening anti-tampering protections and chain-of-custody controls.
CryptoBilis has stopped selling hardware wallets while the investigation continues.
Ledger has previously confirmed that one affected customer’s device contained an unauthorized hardware implant. That moved the investigation beyond a purely theoretical supply-chain concern, although Ledger has not established that the same implant was present in every affected device or that it explains every reported loss.
The distinction remains important because independent researchers have produced much larger theft estimates than Ledger itself has confirmed. On-chain estimates have risen above $90 million, but the company has not endorsed a total loss figure.
SlowMist Adds a Ledger Flex to the Investigation — But Not to the Confirmed Victim List
The most intriguing new technical lead comes from SlowMist founder Yu Xian, better known as Cosine.
Cosine said one of the cases his team is closely tracking in connection with CryptoBilis involves a Ledger Flex. Until now, the Nano X has been the principal model publicly associated with the physical-implant investigation.
That makes the Flex lead potentially important, but it needs to be handled carefully.
Cosine has not said that investigators confirmed an implant inside the Flex, that the device leaked a recovery phrase or that it caused cryptocurrency to be stolen. The information establishes that a Flex appears in a strongly linked case under investigation, nothing more.
That limitation is particularly relevant after an apparent Ledger implant was separately reported in Europe. That device had not been tied to a confirmed theft, and Ledger had not confirmed that it contained the same hardware identified in the CryptoBilis investigation.
In other words, investigators now have multiple leads outside the narrowest version of the original story, but not all of those leads belong in the same bucket of confirmed evidence.
The Bigger Risk Is the Authorized-Reseller Trust Model
The most consequential development on October 12 may not be the Flex at all. It is OneKey’s decision to take action even though no OneKey theft has been reported.
That tells us how hardware-wallet manufacturers are starting to interpret the risk.
The original value proposition of an authorized dealer is simple: customers who cannot buy directly from the manufacturer get a trusted local distribution channel. If that channel itself becomes the suspected point of compromise, the “authorized” label suddenly does much less security work than customers assume.
For manufacturers, that creates an expensive problem. More stringent reseller audits, sealed logistics, serial-number tracking, return controls and anti-tampering inspections all add friction and cost. But once a physical implant is demonstrated in even one customer device, channel security becomes part of the product’s security model.
OneKey’s replacement program effectively acknowledges that. The company is not claiming its own hardware was compromised. It is saying that uncertainty about the custody chain is enough to justify replacing devices and regenerating credentials.
Direct Sales Could Gain a Security Premium
Ledger’s repeated emphasis that its direct-sales channel has not been affected also has a commercial implication.
Hardware-wallet companies may increasingly push customers toward direct purchases, especially in markets where local distributors have historically been necessary for availability, shipping or payment reasons.
That could strengthen manufacturers’ control over inventory but weaken smaller regional dealers and make international distribution more expensive.
The harder question is whether direct shipping can eliminate the risk entirely. It cannot. Products can still be intercepted, returned, substituted or manipulated elsewhere in the logistics chain. What direct sales do provide is fewer intermediaries and therefore fewer points where custody has to be trusted.
The Flex Lead Could Matter Much More If Physical Tampering Is Confirmed
If investigators eventually confirm that a CryptoBilis-supplied Ledger Flex was physically modified, the story changes again.
A confirmed Flex implant would suggest that the operation was not simply exploiting one mature device design. It would indicate either broader technical capability or a distribution process capable of targeting multiple product lines.
There is not enough evidence to make that conclusion now.
The investigation has already demonstrated why restraint matters. Dave Finances recently documented how a $3.89 million Ledger-hacker attribution fell apart after a mislabeled THORChain wallet was identified. Blockchain movements, physical devices and reseller histories can each generate compelling-looking leads that later prove incomplete or incorrectly connected.
For now, the strongest confirmed development is therefore institutional rather than technical: a second major hardware-wallet manufacturer has decided that exposure to the CryptoBilis distribution channel alone warrants emergency action.
Ledger says confirmed theft cases remain limited to CryptoBilis-sold devices. OneKey says none of its customers have reported losses. The Ledger Flex remains an investigative lead rather than a confirmed compromised device.
But OneKey’s dealer freeze, full reseller review and seed-migration warning show that the CryptoBilis incident is already forcing hardware-wallet companies to rethink a basic assumption of self-custody: securing the cryptography is not enough if customers cannot be certain what happened to the device before it reached their hands.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574