The fallout from the Ledger × CryptoBilis tampered-device incident: On Monday, OneKey and Trezor removed CryptoBilis from their authorized dealer lists. Bitquery publicly estimated that around $102M across 324 wallets was stolen; Tether has frozen about $10M in USDT. OneKey says no users have reported losses from the incident so far, but is treating the devices as “potentially risky.”
Action checklist (from OneKey’s official statement, as of 10-12):
· OneKey devices bought from CryptoBilis between 3/1 and the date of the statement: Contact customer support via the bottom-right corner of the official website to request a free replacement. Deadline: 12/31. The old device does not need to be returned.
· Not yet activated: Don’t initialize it; apply directly for a replacement.
· Assets already held in a wallet: First move them to a wallet with a completely new recovery phrase, then wait for the replacement device to arrive. Generate a new recovery phrase on the replacement too; do not import the old one.
· Support will never ask for your recovery phrase or PIN—anyone who does is phishing.
An engineer’s perspective: Verifying the security chip only proves the SE is still there; it doesn’t prove there isn’t an extra LTE chip soldered inside the casing. The integrity of the supply chain is the real threat model for hardware wallets.
You can wait for a replacement. Don’t wait to secure your assets. A “friendly” support agent asking for your seed phrase is scarier than an implanted chip 😏
#链上安全 #硬件钱包 #Anti-Scam
Action checklist (from OneKey’s official statement, as of 10-12):
· OneKey devices bought from CryptoBilis between 3/1 and the date of the statement: Contact customer support via the bottom-right corner of the official website to request a free replacement. Deadline: 12/31. The old device does not need to be returned.
· Not yet activated: Don’t initialize it; apply directly for a replacement.
· Assets already held in a wallet: First move them to a wallet with a completely new recovery phrase, then wait for the replacement device to arrive. Generate a new recovery phrase on the replacement too; do not import the old one.
· Support will never ask for your recovery phrase or PIN—anyone who does is phishing.
An engineer’s perspective: Verifying the security chip only proves the SE is still there; it doesn’t prove there isn’t an extra LTE chip soldered inside the casing. The integrity of the supply chain is the real threat model for hardware wallets.
You can wait for a replacement. Don’t wait to secure your assets. A “friendly” support agent asking for your seed phrase is scarier than an implanted chip 😏
#链上安全 #硬件钱包 #Anti-Scam