Binance co-founder Changpeng Zhao has alleged that hackers may have acquired CryptoBilis, the Southeast Asian reseller linked to a suspected hardware-wallet supply-chain attack, and required its former operators to sign a non-disclosure agreement (NDA) to keep the ownership transition quiet.

“What’s crazier is the hackers apparently bought the reseller and made them sign a non-disclosure agreement to keep their mouth shut,” Zhao wrote on X on October 12. He added: “So many things wrong here…”

Zhao’s allegation comes as former CryptoBilis co-founders Arravind Prabu and Vimalatheethan say they completed their operational handover in March 2026 but were contractually required to delay a joint public announcement of the ownership transition until mid-October.

Their statement confirms the reported acquisition, handover and delayed announcement. However, neither the statement nor Ledger’s public disclosures establish that the new owners were the hackers or that the NDA was intended to conceal the security incident.  

The timing has nevertheless brought renewed scrutiny to CryptoBilis’ ownership history as Ledger investigates reports of cryptocurrency thefts involving devices sold through the reseller.

Seven Months Between Handover and Public Disclosure

In a statement reproduced by blockchain research firm Tibane Labs, Prabu and Vimalatheethan said CryptoBilis was acquired by new ownership earlier in 2026 and that they completed the handover of operational, managerial and administrative responsibilities in March.

They said they had no access to the company’s backend systems, customer databases, order histories, corporate communications or administrative controls following the transition.

The former executives attributed the delay in announcing the ownership change to their acquisition agreements.

“Under the formal acquisition agreements, all parties were contractually bound to hold off on issuing a joint public announcement until mid-October 2026,” they said.  

That leaves approximately seven months between the reported operational handover and the scheduled public announcement.

The statement does not explain why mid-October was selected or establish whether the confidentiality provisions restricted disclosures beyond a joint public announcement. It also does not establish any connection between the agreement and the hardware implants subsequently identified in affected devices.

The timeline is notable because Ledger announced its investigation on October 9, followed by confirmation of an unauthorized hardware implant in at least one affected device on October 10. The planned announcement date and the emergence of the security incident have therefore become intertwined in public scrutiny of the reseller’s ownership transition.  

What Ledger Has Confirmed

Ledger’s initial October 9 announcement said it was investigating reports of cryptocurrency losses among customers in Southeast Asia who had purchased its hardware wallets through CryptoBilis.

As a precaution, the company asked the reseller to pause all sales and shipments of Ledger devices. It also advised customers who had purchased devices through the reseller within the previous 90 days not to initiate setup if their devices remained unused. Customers who had already set up their devices were advised to consider moving their assets to a new Ledger signer using a new recovery seed.  

On October 10, Ledger Support confirmed that a device belonging to one affected user contained an unauthorized hardware implant.

The finding provides evidence of physical tampering in at least one device. Ledger has said its own systems, security infrastructure and services were not compromised, pointing the investigation toward the devices and their distribution chain rather than a confirmed breach of Ledger’s internal systems.  

Independent on-chain investigators have estimated losses ranging from more than $86 million to approximately $93 million. Those figures remain estimates, not a total verified by Ledger. The number of affected customers and the full scope of the incident have also not been definitively established.  

The hardware implant’s discovery does not, by itself, establish who installed it, when the modification occurred or who ordered it.

Former Founders Say Suppliers Were Notified

Prabu and Vimalatheethan said suppliers and partners, including Ledger and Trezor, had been notified of the acquisition and new management structure.

They also said they provided limited advisory and coordination support for industry events earlier in the year, including Bitcoin Pizza Day, MyBW and PBW, but had no day-to-day operational or IT visibility after the handover.

The former executives said they remained willing to provide historical context to Ledger’s investigation team. They directed inquiries about current CryptoBilis operations to Nicholas Chang, identified in their statement as the company’s current lead or person in charge.  

Their account raises questions about what the suppliers were told, when they were notified and what information was available about the ownership and operational transition.

However, the statement does not include copies of the acquisition agreement or supplier communications. The dates and contents of those notifications have not been established by the statement itself.

The distinction matters: a supplier being notified of an acquisition does not necessarily establish what it knew about the new owners, changes in operational control or the handling of existing inventory.

The Ownership Allegation Remains Unverified

Zhao’s post goes beyond questioning the timing of the NDA. It suggests that the people behind the attack acquired the reseller and used the agreement to silence its former operators.

That claim has not been established by the available evidence.

The former co-founders say a new ownership group acquired the company and that they completed the operational handover in March. Separate reporting on corporate records has described a subsequent shareholding change in August. Those dates refer to different aspects of the transition and should not automatically be treated as a single transaction date.  

Neither the former executives’ statement nor Ledger’s public updates establish that the buyer was involved in the tampering. The existence of an NDA and the timing of its reported announcement restriction do not independently prove that the agreement was intended to conceal criminal activity.

The unanswered questions are more specific: why was the joint announcement scheduled for mid-October, what did the confidentiality provisions prohibit, what did Ledger know about the transition, and who had custody of the affected devices before they reached customers?

Those questions are relevant to understanding the reseller’s ownership and distribution chain. They do not, without additional evidence, establish who was responsible for the attack.

What Customers Should Know

While the ownership questions remain unresolved, Ledger’s guidance to potentially affected customers is immediate.

Customers who purchased Ledger devices through CryptoBilis within the 90 days preceding the company’s October 9 warning should follow Ledger’s official instructions. Those who have not initialized their devices were advised not to begin setup; those who have already set them up were advised to consider transferring their assets to a new signer with a newly generated recovery seed.  

Ledger has also urged customers to rely on official support channels and never share their recovery phrases with anyone claiming to represent the company.

CryptoBilis has reportedly suspended sales of its hardware-wallet inventory while the investigation continues. The suspension does not establish the total number of affected devices or resolve how the tampering occurred.  

For now, the central issue is the intersection of three developments: a reported acquisition and March handover, a contractual restriction delaying a joint public announcement until mid-October, and a security investigation involving devices distributed by the reseller.

CZ has alleged that hackers bought CryptoBilis and used an NDA to keep the transition quiet. The former founders’ statement confirms the delayed announcement, and Ledger has confirmed an unauthorized implant in at least one affected device. But the available evidence has not established that the buyer was behind the tampering or that the NDA was intended to conceal it.

The agreement’s terms, the communications with suppliers and the chain of custody for affected devices remain central to determining what happened.

‍