OneKey Cuts Off CryptoBilis Reseller, Offers Free Wallet Replacements

Hardware wallet maker OneKey has terminated its relationship with reseller CryptoBilis and launched a free device replacement program for customers who purchased from the channel partner, citing supply chain security concerns that could expose users to large-scale asset theft.

The replacement offer covers all OneKey models bought from CryptoBilis between March 1, 2026 and October 12, 2026, including used devices. Affected customers have until December 31, 2026 to apply. OneKey has not disclosed the specific nature of the security concern, but the scope of the program and the breadth of the affected window signal that the company views the risk as serious enough to absorb the full cost of replacement rather than leave any customer exposed.

Supply chain integrity is one of the most difficult problems in hardware wallet security. A compromised device can arrive pre-loaded with malicious firmware, a manipulated seed phrase generator, or tampered hardware that leaks private keys without any visible sign of tampering. The threat is not hypothetical: the industry has grappled with counterfeit wallet schemes and supply chain interference for years, and users who rely on third-party resellers have consistently faced higher exposure than those purchasing directly from manufacturers. OneKey's decision to proactively sever the relationship and fund replacements, rather than wait for confirmed theft reports, reflects a calculated prioritization of user asset security over near-term revenue.

Several questions remain unanswered. The nine-month window of potentially affected devices raises a pointed concern: if CryptoBilis posed a supply chain risk, why did it take until October 12 to identify and act on it? Users who purchased early in that window and have been actively using their wallets for months may have already experienced unauthorized access without realizing the source. OneKey has not indicated whether it has received reports of actual asset losses tied to CryptoBilis-sourced devices, and the absence of that disclosure leaves affected users with limited information to assess their own risk. The December 31 application deadline also creates a practical problem for customers who may not learn about the program in time, particularly those who purchased used devices and have no direct relationship with OneKey's communication channels.

Hardware wallet supply chain attacks have historically been difficult to detect and devastating when exploited. A compromised device that silently records a seed phrase at setup can sit dormant for months before funds are drained, often timed to when a wallet balance reaches a threshold worth targeting. OneKey's move establishes a clear precedent: when a reseller relationship creates unacceptable security uncertainty, the correct response is termination and full customer remediation, not a quiet audit. Whether other manufacturers will adopt similar standards for reseller oversight remains an open question, but the reputational cost of inaction in a supply chain compromise scenario is now well-documented.

Customers who purchased a OneKey device from CryptoBilis during the affected period should apply for a replacement before the December 31 deadline regardless of whether they have observed any suspicious activity. A wallet that appears to function normally is not evidence of a clean device. OneKey has not published technical details about what specifically prompted the termination, which means the safest course for any affected user is to treat their current device as untrusted, avoid generating new addresses or signing transactions on it, and migrate funds to a verified replacement before the application window closes.