CryptoBilis Changed Ownership Months Before Ledger's $93M Wallet Drain Scare

Published October 10, 2026, 17:37 PKT. Based on company records reported by Cointime and BitPinas on October 10, 2026, Ledger's official statements, and on-chain analysis from Specter and Bitquery.

Corporate records surfaced on October 10 showing that CryptoBilis, the Malaysian hardware wallet distributor at the center of Ledger's $93 million wallet-drain investigation, changed ownership months before the thefts came to light.

The March acquisition and the August shareholding

Newly disclosed company records show that an individual named Jiaming, with a registered address in Heilongjiang Province, China, has held 100% of CryptoBilis's shares since August 3, according to Cointime. A former co-founder of the company confirmed that CryptoBilis was acquired in March of this year, and that the original shareholders subsequently exited all operational, management and administrative roles.

The founding team said it has been unable to understand the company's actual operations since the handover and now only assists with some coordination of activities, according to Cointime. "We are no longer part of the company," the former co-founder said, urging the current management to handle the incident transparently. There is currently no conclusive evidence linking the ownership change to the wallet thefts, Cointime noted, and BitPinas independently reported the ownership records on October 10.

The $93 million drain that triggered the probe

Ledger said on October 9 that it is investigating reports of lost funds from users in Southeast Asia who purchased its hardware wallets through CryptoBilis, and asked the reseller to pause all sales and shipments while the review continues. On-chain investigator Specter traced more than $86 million drained across Bitcoin, Ethereum and TRON from hundreds of victim wallets, while blockchain analytics firm Bitquery estimated about $92.9 million stolen from 311 wallets across five networks: Bitcoin, Ethereum, TRON, BNB Chain and Polygon.

As MABOnChain reported on October 10, Tether froze about $10 million in USDT tied to the incident, and on-chain data showed the thief sent 1,254 ETH to Tornado Cash. Binance co-founder Changpeng Zhao said on X that the incident appeared to be "a localized supply-chain attack with one vendor," adding that a small number of people probably bought fake or tampered Ledgers. Ledger advised customers who bought devices from CryptoBilis in the last 90 days not to set them up if they have not done so yet, and to move assets to a new Ledger signer with a new seed phrase if they already have.

Stores shuttered across three countries

CryptoBilis has temporarily suspended sales and shipments of all brand hardware wallets across its stores and online channels in Malaysia, the Philippines and Indonesia, and has closed its physical stores until further notice, according to Cointime. The reseller is listed as an official Ledger distributor in all three countries, and Ledger has said the suspected thefts are limited to devices sold through that one channel.

This article is news reporting and is not investment advice.

Sources

• Cointime flash news, "New Clue in Ledger Theft Case" (Oct. 10, 2026), company records, primary source
• Ledger Support official statement on X (Oct. 9, 2026), primary source
• BitPinas (Oct. 10, 2026), secondary source
• Specter and Bitquery on-chain analysis, secondary sources
• Changpeng Zhao on X (Oct. 9, 2026), secondary source