(Oct 13): Crypto hardware maker OneKey has revoked CryptoBilis’s authorisation as a reseller of its products, widening the fallout from the discovery that some Ledger wallets sold through the Malaysian retailer had funds stolen.
“We have no reports of OneKey users losing assets in this incident but we are acting as if the risk is real,” Hong Kong-based OneKey said in a statement on its website. “CryptoBilis is no longer an authorised OneKey reseller.”
Paris-based Ledger SAS said it is investigating reports that users lost funds after buying its hardware wallets through CryptoBilis. The on-chain research group YFarmX estimates that as much as US$103 million (RM420.77 million) was stolen. Ledger has not confirmed the amount lost but said it verified that one affected user’s device contained an unauthorised hardware implant.
The incident is the latest in a series of attacks to plague the crypto industry in recent months, including the theft of more than US$100 million in bitcoin from Coldcard-branded wallets made by Canada-based Coinkite Inc. Hardware wallets, commonly used for cold storage, are considered among the more secure methods of holding cryptocurrency because they use physical devices to store private keys offline.
CryptoBilis said on Oct 10 it had paused the sale and shipment of all hardware wallets across its stores and online channels in Malaysia, the Philippines and Indonesia.
“We are doing this as a precaution, to protect our customers while Ledger’s investigation continues and while we review our own processes with the help of independent specialists,” it said in a post on X.
Following the reports, CryptoBilis co-founder Arravind Prabu posted on LinkedIn that the reseller was acquired earlier this year and that management responsibilities were handed over in March. CryptoBilis didn’t immediately respond to an emailed request for comment.
Ledger said the number of impacted devices is limited and it is working with relevant authorities.
“We know this is concerning, especially for those directly affected and we are reaching out to impacted users,” it said in a post on X. All confirmed cases related to the incident involve devices sold through CryptoBilis, it added.
OneKey said devices bought from CryptoBilis between March 1 and Oct 12 can be replaced for free. It has also stopped onboarding new resellers and will review existing ones, it said.
OneKey, a rival to hardware-wallet makers Ledger and Trezor, is backed by Coinbase Ventures and YZi Labs, the family office of Binance Holdings co-founders Changpeng Zhao and Yi He.
Uploaded by Arion Yeow