OneKey Offers Free Replacements After Cutting CryptoBilis

OneKey has cut off CryptoBilis as a reseller and is offering a free replacement to anyone who bought a OneKey hardware wallet through the company since March 1. Every model qualifies, activated or not, and the deadline to apply is December 31, 2026.

The offer is generous in one small but telling way: you keep the old device. OneKey ships the new one straight from its own store.

Who Qualifies and How to Apply

Any OneKey hardware wallet bought from CryptoBilis between March 1, 2026 and the statement's Oct 12 date qualifies, whether or not it was ever opened, activated or used.

• Purchase window: March 1, 2026 to Oct 12, 2026
• Any OneKey model, activated or not
• Proof of purchase or receipt, which OneKey lists as required
• Application deadline: December 31, 2026
• Nothing to ship back

To apply, go to the OneKey website, click the support button in the bottom-right corner, and say you are applying for the CryptoBilis replacement. Bring your proof of purchase or receipt, your device model, and whether the device has been activated or used, as OneKey's statement asks.

If your model is out of stock, OneKey says it will upgrade you to a newer model at no cost. Whether shipping is covered beyond the device itself is not addressed in the statement.

What to Do With a Device You Already Use

OneKey splits its guidance by whether the device has been set up.

If it has not been activated, don't activate it. Apply for a replacement instead.

If you are already using it and holding assets on it, OneKey advises treating the current recovery phrase as possibly compromised and moving those assets to a wallet with a brand-new recovery phrase as soon as you can.

When the new device arrives, don't import the old recovery phrase into it, and don't import the recovery phrase from a temporary app wallet either.

One warning applies throughout. OneKey says its support team will never ask for your recovery phrase or PIN, and that anyone who asks for them in the name of a replacement or a verification is a scammer.

Why OneKey Acted

OneKey says it has not received any report of a OneKey user losing assets in connection with this incident. It adds a line that does the real work here:

But no reports does not mean no risk.

The event itself did not start with OneKey. Ledger confirmed in an Oct 10 statement that one impacted user's device contained an unauthorized hardware implant. In an Oct 11 update, Ledger said all confirmed cases tied to the draining incident of Oct 9 involve devices sold through CryptoBilis.

Third-party on-chain researchers estimate the loss at $86 million to $93 million, taken from more than 300 wallets across Bitcoin, Ethereum and Tron. CryptoBilis operates in Indonesia, Malaysia and the Philippines. It sold OneKey, Trezor, Tangem, SafePal, imKey and other brands alongside Ledger, and it has suspended sales of all hardware wallet inventory until the investigation concludes.

The March 1 start date traces back to a former CryptoBilis co-founder, who said publicly that the company was acquired earlier this year and that management was handed over in March. OneKey chose a wider window deliberately. "We would rather cover too much than too little."

One claim going around remains unverified. CZ alleged that the attackers bought the reseller and had it sign a non-disclosure agreement to keep quiet. That has not been independently confirmed.

Resellers Are Being Reviewed Now

Effective immediately, OneKey has stopped onboarding new resellers. It is re-reviewing every existing one, and will revoke authorization where it cannot verify a reseller's business entity or where the ultimate beneficial owner is unclear. Those resellers are removed from the site as well.

When the review finishes, OneKey will publish the complete list of authorized resellers on its own website. From then on, anyone not on that list is not an authorized OneKey reseller.

That list is the practical thing to check the next time you buy a OneKey anywhere other than the official store.