OneKey has ended its partnership with CryptoBilis, cutting off the supplier and offering free wallet replacements to users who may be affected. The hardware wallet maker said the decision was driven by supply chain security risks that could lead to large-scale asset thefts.
The move turns a quiet vendor relationship into a public warning. OneKey didn't detail exactly how the supply chain was compromised, but the language in its notice is blunt: the risks were serious enough to justify a full cut-off and replacements at the company's expense.
What CryptoBilis did for OneKey
CryptoBilis operated as a supplier or partner in OneKey's chain. The specifics of that role weren't spelled out in the announcement. What matters is that OneKey decided the relationship couldn't continue — and that the risk wasn't limited to new orders. Existing users are being told to swap wallets, not just stop buying from the affected channel.
Supply chain attacks in hardware wallets are particularly nasty. A compromised device can be tampered with before it ever reaches a customer, meaning the user's private keys could be exposed from day one. The wallet looks fine. It works fine. Then funds disappear.
Free replacements, but details are thin
OneKey is offering free wallet replacements to affected users. For a hardware wallet company, that's the right call — asking customers to pay to fix a security problem they didn't create would be a harder sell. But the announcement leaves open questions. How many wallets are in scope? How do users know if they're affected? What's the turnaround time? OneKey hasn't said publicly, at least not yet.
Users who bought through CryptoBilis channels should assume they're in the affected group until OneKey says otherwise. The company hasn't published a serial number checker or a batch list. That's the kind of detail that usually follows a first announcement, so expect an update.
The bigger problem for hardware wallets
Hardware wallet makers sell trust. The whole pitch is that your keys never touch an internet-connected device. When a supply chain partner becomes a liability, the trust takes a hit — even if the manufacturer did nothing wrong. OneKey is trying to get ahead of that by acting fast and eating the cost of replacements.
Whether that's enough depends on how the story develops. If the compromised devices were limited to a specific batch or region, the damage is containable. If the exposure is broader, OneKey will need to explain why it took until now to cut ties.
The company hasn't said when it first learned of the issue. That's the question users will ask next, and it's the one OneKey should answer before someone else does.
