CryptoBilis Founder Says Reseller Changed Hands Before Wallet Drains

CryptoBilis founder Arravind Prabu said the Southeast Asian hardware-wallet reseller changed hands in March, months before Ledger devices sold through the company were linked to a major wallet-draining incident.

Prabu said new owners acquired CryptoBilis earlier in 2026 and took operational and administrative control in March. He said he and co-founder Vimalatheethan no longer had access to the company’s backend systems, customer databases, order histories or corporate communications after the handover.

Prabu said the former founders provided limited advisory and event-coordination support but had no visibility into daily management or information-technology infrastructure. Contractual restrictions prevented the transaction from being disclosed publicly until mid-October, he said.

“zero access, credentials, visibility, or administrative control over Cryptobilis backend systems, customer databases, order histories, or corporate communication channels,” Prabu said.

The disclosure follows cryptocurrency losses involving Ledger devices sold through CryptoBilis, which serves customers in Indonesia, Malaysia and the Philippines. Ledger said Oct. 10 that one affected user’s device contained an unauthorized hardware implant.

On Oct. 11, Ledger said all confirmed cases tied to the Oct. 9 draining involved devices sold through CryptoBilis. The company said its internal systems and direct sales channels were unaffected.

An on-chain estimate updated at 8:52 a.m. ET Oct. 12 (12:52 p.m. UTC) put the losses at $102.0 million across 324 wallets on TRON, Bitcoin, Ethereum, Solana, BNB Chain and Polygon. The estimate also counted $10.0 million in USDT frozen across 20 wallets.

Blockchain activity shows that the attacker controlled keys linked to wallets across the six networks, but it does not establish how every key was obtained. Ledger has confirmed an implant in one device, while the broader cause of the losses remains under investigation.

The ownership change has not been linked to the exploit, and the buyer’s identity remains undisclosed. Ledger has also not established that the confirmed implant caused every reported loss.

Ledger advised customers who bought devices through CryptoBilis not to initialize unused devices. Users with active wallets were told to move their assets to a new Ledger device with a newly generated recovery seed.

The company previously linked confirmed draining cases to CryptoBilis-sold devices.