Recently, several users reported losing crypto assets from Ledger hardware wallets purchased through CryptoBilis. Ledger subsequently confirmed the presence of unauthorized hardware implants in certain affected devices. The exact cause and scope of the incident remain under investigation.
CryptoBilis was previously an authorized imKey reseller. We understand that users who purchased imKey devices through this channel may have concerns about their devices’ security. This statement outlines the information currently available to us, the actions we have taken, and the precautions we recommend to users.
1. What We Currently Know
We have contacted CryptoBilis to verify the situation. According to CryptoBilis, the security incidents reported to the reseller so far have primarily involved Ledger devices. CryptoBilis also stated that it has not received any reports of security incidents involving imKey devices.
This information comes from the reseller and does not constitute confirmation that all imKey devices sold through this channel are secure. We will continue to investigate and update this announcement with verified information.
2. Measures We Have Taken
We have terminated our partnership with CryptoBilis and temporarily suspended the onboarding of new authorized resellers. We have also initiated a review of our existing authorized resellers. The review covers reseller registration details, ultimate beneficial ownership, and any relevant changes in ownership or corporate structure. Particular attention is being paid to device sourcing, storage, handling, and shipping practices. We will update the list of authorized resellers on our official website as the review progresses.
imKey primarily distributes its products through official direct sales channels, supplemented by a limited network of authorized resellers. Orders placed through our direct sales channels are shipped directly by imKey, and authorized resellers are required to source devices directly from imKey. These arrangements help minimize intermediary involvement and improve supply chain traceability. We will further strengthen our channel management in light of this incident.
3. What Should Users Who Purchased imKey Through CryptoBilis Do?
If you purchased an imKey device through CryptoBilis, please contact imKey Support at support@imkey.im with the following information: your purchase date, order number or proof of purchase, device model, and whether the device has been initialized or used. This information will help us review your purchase channel and device status. Do not include your mnemonic phrase, private keys, PIN, or binding code in the email or attachments.
If your device has not been initialized:
As a precaution, please do not initialize the device or use it to create or restore a wallet. Contact imKey Support for further guidance before proceeding.
If your device is already in use:
Please contact imKey Support and provide details of your device's initialization and usage history. If you notice any device abnormalities or unauthorized transfers, notify us promptly and retain your order records, packaging, device photos, and relevant transaction records.
If you suspect that your recovery phrase may have been compromised, use a trusted, independently verified hardware wallet to generate a new recovery phrase, and transfer your assets to the newly generated wallet addresses. Importing the original recovery phrase into a new device does not eliminate the risk that it may already be compromised. If you have any questions, please contact imKey Support before proceeding.
These are precautionary recommendations for users who purchased through this channel. They do not mean that imKey devices have been confirmed to be affected by this attack.
4. What Should Users Who Purchased Through Other Channels Keep in Mind?
We recommend purchasing imKey devices through the official sales channels listed on our website. If you choose to buy from a reseller, check the latest reseller authorization information on our website before purchasing.
After receiving your device, complete the checks described on our imKey Verification page. These checks may help identify signs of tampering or other irregularities. However, normal packaging, appearance, or activation status does not guarantee that a device has not been tampered with. If you notice anything unusual, stop using the device and contact imKey Support. We do not recommend disassembling the device yourself.
When creating a new wallet, use only a mnemonic phrase generated by the imKey device itself. Never use a mnemonic phrase supplied by a seller or pre-filled on a backup card.
5. Official Support and Further Updates
imKey Support will never ask you to disclose your recovery phrase or private keys, enter them on a website, or share them with support staff. We will also never instruct you to transfer assets to a so-called “safe account.” Beware of scams claiming to offer device checks, replacements, or asset protection.
Official support: support@imkey.im
Official website: https://imkey.im
Device Self-CheckGuide:
https://support.imkey.im/hc/en-001/articles/60601101048217
Checking imKey Pro Hardware Integrity:
https://support.imkey.im/hc/en-001/articles/63393150897689
We will continue to monitor this incident, investigate the relevant sales channels, and publish verified material updates on our official website.
imKey Team
October 19, 2026
0 comments
Please sign in to leave a comment.