Ex-CryptoBilis head Arravind Prabu denies role in Ledger wallet thefts

In short

• Arravind Prabu, former head of reseller CryptoBilis, denies involvement in the Ledger-linked theft of users' assets.
• Prabu says CryptoBilis was acquired and he handed over all control in March, losing system and database access.
• Ledger says all confirmed cases in the 9 October thefts involve devices sold via CryptoBilis, and its own sales are unaffected.
• Third-party security firms put losses near $90m; Ledger has not confirmed that figure, and Tether has frozen linked USDT.

Arravind Prabu , the former head of the South-East Asian reseller CryptoBilis, has denied any involvement in the security incident that hit customers of hardware wallet maker Ledger, according to a statement carried by Cointelegraph. Prabu said CryptoBilis was acquired by new management and that he handed over all operational, executive and administrative responsibilities in March. After that handover, he said, he no longer had access to or control over the company's internal systems, customer database, order records or corporate communication channels.

CryptoBilis is a Malaysia-based reseller that sold Ledger hardware wallets, the physical devices people use to store crypto keys offline. Ledger is a French maker of those wallets, and its customers who bought through CryptoBilis are at the centre of the incident. The thefts were reported on 9 October, when Ledger said it was investigating customer losses after devices were bought from the reseller, according to CryptoSlate.

Prabu says he left CryptoBilis in March

Prabu made the same points in his own posts on X on 9 October. He said the company was acquired earlier this year and that he and his team "fully stepped down from all operations, system access, and management", pointing current queries to Nicholas Chang at CryptoBilis. In a second post he said the new management runs the account, that a confidentiality clause bound him to hold off on public announcements until 19 October, and that he has no access to CryptoBilis accounts, backend or operations.

What Ledger has and hasn't confirmed

Ledger has confirmed the CryptoBilis link, but not the size of the loss. On 11 October the company said all confirmed cases in the 9 October coin theft incident involve devices sold via CryptoBilis, and that its own systems and direct sales were unaffected, according to PANews. Ledger also said it is working with law enforcement and that CryptoBilis will stop selling all hardware wallets. The roughly $90m figure comes from third-party security firms, not from Ledger itself, according to CryptoSlate.

Who carries the loss

The people most exposed are ordinary holders who bought a Ledger device through CryptoBilis and later found coins missing. Tether has frozen USDT linked to the incident, according to CryptoSlate, which may help recover some funds but does not restore what was taken. For traders, the incident is a reminder that a hardware wallet is only as safe as the route it travelled to reach you. For CryptoBilis, the practical effect is already visible: it will stop selling all hardware wallets, according to PANews.

A fake Ledger site drew 1m visits

A separate thread in the case involves a fake Ledger website and app that appeared at the top of Google search results, according to the security researcher @cyberscrilla, who said the pages were built to trick users into revealing their 24-word recovery phrase and drew over 1m visits in 30 days, as reported by Odaily. That is a different attack from the reseller question, and it points to the same weak spot: the phrase that controls a wallet, not the device itself.

Ownership changed in March

Ownership of CryptoBilis also shifted this year. KuCoin's news flashes reported on 9 and 10 October that the company's ownership changed in March and transferred to a Chinese individual, citing BlockBeats and Huoxing Finance, as investigators looked into a suspected supply chain attack on Ledger devices. Those reports line up with Prabu's account of a March handover, though they do not settle who controlled the company when the affected devices were sold.

It isn't clear yet whether Ledger will publish its own loss figure, or when. What is confirmed is narrower: Ledger says the affected devices came through CryptoBilis, CryptoBilis will stop selling hardware wallets, and law enforcement is involved. Prabu's denial rests on his own statement and posts, and no one else has confirmed his account of the handover.

Related on InvestIn.News

• Ledger tells CryptoBilis to pause sales during probe into $86m thefts
• Ledger confirms hardware implant in customer wallet after $93.4m losses
• MetaMask exits Lido validators amid security incident probe

Questions readers ask

What has Arravind Prabu said about the CryptoBilis Ledger incident?

Arravind Prabu, former head of reseller CryptoBilis, said he had no involvement in the Ledger-linked thefts. He said CryptoBilis was acquired by new management and he handed over all operational, executive and administrative duties in March, losing access to its systems, customer database, order records and communication channels, according to a statement carried by Cointelegraph.

Has Ledger confirmed the $90m loss figure?

No. Ledger has confirmed that all confirmed cases in the 9 October thefts involve devices sold via CryptoBilis, and that its own systems and direct sales were unaffected, according to PANews. The roughly $90m figure comes from third-party security firms, not from Ledger itself, according to CryptoSlate.

What happens to CryptoBilis hardware wallet sales?

Ledger said CryptoBilis will stop selling all hardware wallets, according to PANews. Ledger also said it is working with law enforcement on the 9 October thefts. Tether has frozen USDT linked to the incident, according to CryptoSlate, which may help recover some funds.

Our view

The March handover is the crux of this case, and it deserves more scrutiny than a press statement. Prabu's position is that CryptoBilis was sold and that he surrendered all operational, executive and administrative control months before the thefts surfaced on 9 October. If that is accurate, responsibility for the affected devices rests with the new owners, and the confidentiality clause he cites until 19 October explains his silence rather than proving his innocence. The timing, however, is convenient: a sale completed in March, disclosed only when investigators began examining a suspected supply chain attack on Ledger devices. Ledger has confirmed the CryptoBilis link but not the roughly $90m loss figure, which remains a third-party estimate. In my view, the handover should be verified against company records and the acquisition terms. A clear, dated transfer of systems, customer data and order records would settle the question; anything less leaves the CryptoBilis ledger incident unresolved.

Follow the latest updates as they happen on NewsFeeds.

— Keshav Aggarwal

What to watch: Ledger has not said whether it will publish its own loss figure, and Prabu's account of the March handover has not been confirmed by anyone else.