CryptoBilis, the South East Asian Ledger reseller at the centre of the wallet-draining case, was sold to new owners months before the thefts, according to its former co-founders. Binance founder Changpeng “CZ” Zhao has gone further, alleging on X that the buyers were the hackers. No public evidence supports that, and nothing so far links the change of ownership to the implants or the drains.
TSN has covered Ledger’s investigation and sales pause, and its confirmation of a hardware implant in one device, in earlier posts (see Related stories). This post is about who owns the reseller.
What the former founders say
REPORTED. TSN has not seen the statement. Former co-founders Arravind Prabu and Vimalatheethan said in a statement shared on social media that new owners acquired CryptoBilis earlier in 2026. They said they stepped down and completed the handover in March 2026, and that they have had no access to the company’s systems or customer data since [2][3].
They said suppliers were told about the change, and that under the acquisition agreements a joint public announcement was to wait until “mid-October 2026” [2][3]. They name Nicholas Chang as the person now in charge of CryptoBilis. ETHNews says the statement was posted on LinkedIn; Fintech News Malaysia says Facebook [2][3].
What company records reportedly show
REPORTED. TSN has not seen the filing. Lookonchain, an on-chain analytics account, cites company records showing that an individual named Jiaming, with a registered address in Heilongjiang Province, China, held 100% of CryptoBilis’s shares as of 3 August [4]. Lookonchain itself notes there is no conclusive evidence linking the ownership change to the breach.
What CZ alleges
UNCONFIRMED ALLEGATION. On X at 22:28 BST on 11 October, CZ wrote: “What’s crazier is the hackers apparently bought the reseller and made them sign a non-disclosure agreement to keep their mouth shut. So many things wrong here…” [5]
That is CZ’s claim, not a finding. Benzinga reports that he was repeating a post by the X user Bala (@BalaiBB), who had claimed that an unnamed company quietly bought CryptoBilis [6][7]. Neither post offers evidence for who the buyers are or for any link to the implants.
What Ledger has said
CONFIRMED (Ledger’s own post). In a “72 hour update” on X at 18:13 BST on 11 October, Ledger said that “all confirmed cases” related to the 9 October draining “involve devices sold through the Southeast Asia reseller CryptoBilis”, and that “our systems and direct sales channels remain unaffected” [8]. It added: “We are reminding our authorized resellers and distributors to source products only through authorized channels and never to restock returned products.” [8]
Ledger has not commented on the ownership change. Its update does not mention it.
What is not known
- There is no public evidence linking the new owner, the March handover or the non-disclosure agreement to the implants or the drains.
- Who Nicholas Chang is, and what role, if any, Jiaming plays in running the business.
- When or where the implants were added. Ledger has not said.
The Defiant, which first reported the ownership angle with CZ’s comments, says the former founders’ acquisition agreement delayed the announcement until mid-October [1].
Sources
- The Defiant, “CZ Alleges Hackers Bought CryptoBilis as Ledger Probes Wallet Drains”, 12 October 2026. https://thedefiant.io/news/security/cz-alleges-hackers-bought-cryptobilis-as-ledger-probes-wallet-drains
- ETHNews, “Ledger Buyers Lost Millions as Spy Chip Found Inside a Wallet”, 12 October 2026. https://ethnews.com/ledger-buyers-lost-millions-to-a-spy-chip-hidden-under-the-screen/
- Fintech News Malaysia, “Ledger Probes Suspected US$86M Crypto Theft Linked to Malaysia’s CryptoBilis”, 12 October 2026. https://fintechnews.my/61364/blockchain/ledger-cryptobilis/
- Lookonchain, feed post 76180, October 2026. https://www.lookonchain.com/feeds/76180
- Changpeng Zhao (@cz_binance), post on X, 11 October 2026. https://x.com/cz_binance/status/2109395636907032838
- Bala (@BalaiBB), post on X, 10 October 2026. https://x.com/BalaiBB/status/2108847529919980021
- Benzinga, report on CZ’s comments, 12 October 2026.
- Ledger (@Ledger), “72 hour update on reseller CryptoBilis incident”, post on X, 11 October 2026. https://x.com/Ledger/status/2109331538072494364
