Ledger Stax vs OneKey Neo

On 9 October 2026 Ledger began investigating fund losses reported by people who had bought devices from CryptoBilis, a Southeast Asian reseller, and asked the reseller to stop selling and shipping them. On 13 October Ledger’s Donjon security team described what it found inside an affected device: a separate circuit hidden in the enclosure that read the recovery phrase off the screen during setup and sent it out over LTE through an eSIM.

According to Ledger, the implant did not modify the Secure Element, the operating system, transactions or signatures, and there is no indication that Ledger’s own systems were compromised. Ledger’s support documentation notes that Genuine Check cannot detect an added component when the original Secure Element is intact. Every confirmed loss involved a device sold by CryptoBilis; Ledger said it was still examining reports of implants in devices bought elsewhere. MediaMarkt Saturn suspended Ledger sales in Europe after a customer in Germany reported a tampered unit. On-chain researchers estimated losses above $86 million; Ledger has not verified that figure.

In its statement of 15 October Ledger called the incident a localized distribution attack rather than a systemic supply-chain attack. It asked its authorized resellers and distributors to suspend sales in Southeast Asia and Hong Kong, and said every device it bought and opened in stores to check, including in Germany, was clean. Ledger has not published how many devices or users were affected; it says devices returned by buyers may never be resold and will publish more details later.

If you are buying or already own a Ledger device:

• Buy from Ledger directly or from a reseller on Ledger’s authorized list.
• Do not set up a device bought from CryptoBilis. If you already did, Ledger advises moving your assets to a new device with a newly generated recovery phrase.
• If you lost funds, Ledger asks you to contact law enforcement before opening the device.

The incident concerns how devices reached buyers, not the device design, so it does not change our ratings. We will update this notice as Ledger publishes its findings.

After Ledger found hardware implants in Ledger devices sold by the reseller CryptoBilis, OneKey ended CryptoBilis’s authorization, paused new resellers and began reviewing existing ones. OneKey says no OneKey user has reported losing funds and does not report finding a tampered OneKey device.

As a precaution, OneKey replaces for free any OneKey model bought from CryptoBilis between 1 March and 12 October 2026, activated or not, with proof of purchase. Apply through OneKey support by 31 December 2026; the old device does not need to be returned.

OneKey’s advice: do not activate an unused CryptoBilis unit. If a device from CryptoBilis already holds funds, move them now to a wallet with a newly generated recovery phrase rather than waiting for the replacement.

This concerns one reseller, not the device design, so it does not change our ratings.