Key Notes
- CryptoBilis’s former co-founders say they completed a management handover in March and no longer had access to the reseller’s systems.
- Ledger says all confirmed cases in the October 9 incident involve CryptoBilis devices, while its own systems and direct sales remain unaffected.
- The ownership statement does not establish who modified the wallets, and Ledger’s warning to affected buyers remains in place.
CryptoBilis’s former co-founders say they handed over control of the hardware-wallet reseller in March 2026, months before the Ledger theft investigation became public. Their account adds an ownership timeline without establishing who tampered with the affected devices.
Arravind Prabu and Vimalatheethan outlined their position in a statement supplied to Tibane Labs. Ledger, meanwhile, says all confirmed cases related to the October 9 draining incident involved devices sold through CryptoBilis.
The manufacturer’s October 11 update describes the number of impacted devices as limited, without providing a count. It says its own systems and direct sales channels remain unaffected, while investigators continue working with authorities.
Ledger’s October 11 update on the CryptoBilis investigation and guidance for affected buyers.
— Ledger (@Ledger) October 11, 2026
Former Founders Describe a March Handover
The pair say new owners acquired CryptoBilis earlier this year and that they transferred operational, managerial and administrative responsibilities in March. Since then, they say, they have had no access to backend systems, customer databases, order histories or corporate communications.
They acknowledge assisting incoming management at industry events, describing that work as advisory support without visibility into daily operations or IT infrastructure. Acquisition agreements required a joint announcement to wait until mid-October, they add, while suppliers had already been notified.
The founders offer historical context to Ledger and direct current operational inquiries to existing management. Their statement does not identify the attacker or explain when devices were modified.
CoinScreamer has not independently verified the acquisition documents or system-access records. The March timeline is the former founders’ account, and an ownership transfer alone is not evidence that either former or current management participated in tampering.
Ledger Has Confirmed an Implant in an Affected Device
The ownership statement follows a concrete finding in the investigation. On October 10, Ledger confirmed that an affected user’s device contained an unauthorized hardware implant. It did not name the device model, publish a technical teardown or identify who installed the component.
As our earlier company update explains, finding an implant in one examined unit does not establish that every device sold by CryptoBilis was modified. Ledger said the reseller had suspended sales of its entire hardware-wallet inventory until the investigation concludes.
Ledger also said it was contacting affected users and cooperating with authorities, with support from security response group SEAL 911. Neither its October 10 confirmation nor its October 11 follow-up provides a final, verified total for the reported losses.
Earlier Theft Reports and Separate Research
CoinScreamer’s initial coverage examined investigator Specter’s preliminary estimate of more than $86 million in suspected thefts across Bitcoin, Ethereum and TRON. That figure came from onchain tracing and user reports; it remains distinct from a company-confirmed accounting.
Our subsequent reseller report covered Ledger’s sales-pause request and analyst Darkfost’s concern that losses could be wider. Those early assessments should not be added together or treated as proof that every reported outflow shares one cause.
Separate implant research examined Nano X units acquired through Japanese marketplaces. Tibane says neither specimen came from CryptoBilis and that it has no evidence connecting them to the reseller.
A later European report concerned photographs of another apparently modified device. Its retailer and purchase history remained unverified. That report should not be confused with Ledger’s narrower statement about confirmed cases in the October 9 incident.
The Warning for CryptoBilis Buyers Remains in Place
Ledger’s latest instructions address customers who bought through CryptoBilis: do not initialize unused devices; if already set up, move assets to a new seed generated on a device obtained from Ledger. The October 11 notice does not repeat the 90-day purchase window in its initial warning.
The new seed matters as much as replacement hardware. Ledger’s security guidance explains that restoring a recovery phrase recreates access to the same wallet. If that phrase is exposed, importing it into another device does not remove an attacker’s access.
Affected users are directed to official support and local law enforcement. Ledger says it will never call, send a direct message or ask for a user’s 24-word recovery phrase.
Reseller Controls Are Part of the Response
Ledger says it is reviewing authorized-reseller controls and advancing hardware protections. It has reminded distributors to source products through authorized channels and never return previously sold devices to stock.
The remaining questions concern where tampering occurred, how modified units reached buyers and which losses investigators can connect to them. The former founders’ account is relevant to that timeline, but it does not resolve those questions or change the precautions Ledger has issued to CryptoBilis customers.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
