Key Insights Ledger wallet hack: CZ questioned an NDA linked to a Malaysian reseller’s ownership transfer amid an $80M+ crypto theft investigation. Bitquery traced $93.2 million in alleged lo
The Ledger wallet hack took an unexpected turn on October 11 after Binance founder Changpeng Zhao (CZ) questioned a non-disclosure agreement (NDA) tied to the ownership transfer of a Malaysian wallet reseller. The case involves more than $80 million in alleged crypto losses.
Notably, the restrictive agreement prevented the former owners from speaking publicly about the deal before October 19. At the same time, an investigation already established the presence of an unauthorized hardware component in one of the devices.
Importantly, the matter of CryptoBilis’ ownership transition has little to do with the Ledger wallet hack since it is unclear if the change had anything to do with the tampering that allowed hackers to steal crypto.
As reported by various media outlets, CryptoBilis changed ownership back in March 2026. According to the corporate research conducted by the publication, one individual, Jiaming, was reported to own the crypto wallet reseller as of August 3, with a share of 100%.
The reseller was an authorized Ledger distributor that supplied crypto wallets to Malaysia, Indonesia, and the Philippines.
Arravind Prabu and Vimal Selvamany, CryptoBilis’s founders, had reportedly given up their administrative privileges and control of the firm.
“This is the reason why it was not public. We could not make an announcement before October 19 due to a confidentiality agreement,” Prabu noted in his public statement.
Ledger Wallet Hack Saga | Source: X
Essentially, the timing of the agreement raises questions about the supposed Ledger crypto theft that was reported on October 9, just ten days before the scheduled end of the NDA.
That said, the reports do not indicate that the buyer was in any way responsible for the crypto theft, that the NDA concealment had anything to do with the crime, or that the deal facilitated the Ledger wallet hack.
The agreement itself explained the delay in announcing the sale, as reported by the former owners. It had nothing to do with the alleged crypto wallet tampering.
CZ’s statement only added fresh fuel to the fire. Understandably, the ownership transition has little to do with the supposed theft of crypto.
At this point, the mystery of the Ledger wallet drain is twofold – how the devices got compromised and what allowed the cyber-thieves to intercept the recovery phrase.
One aspect of the Ledger crypto theft investigation deals with the circumstances of the wallet tampering. It appears that some of the crypto wallets sold by CryptoBilis had been modified to facilitate the data interception.
As previously reported, independent crypto sleuths initially estimated the amount of crypto stolen to be worth over $86M. More than 300 users were impacted, all of whom bought the Ledger wallets from CryptoBilis.
Following the initial report, crypto analytics company Bitquery published its findings, confirming that $93.2M worth of crypto was stolen through 315 wallets across 6 chains – TRON, Bitcoin, Ethereum, BNB Chain, Polygon and Solana. Ledger has yet to confirm the total amount of crypto stolen.
The nature of this crime is substantially different than a traditional hacking incident because, on October 10, Ledger revealed one of the affected users had a CryptoBilis-purchased wallet that featured an unauthorized physical implant. The company insisted that its infrastructure, systems, and network have not been compromised.
Crypto experts believe that such implants can be used to relay the recovery phrase, thereby giving the hackers remote access to funds. This theory involves the implant receiving and storing the recovery phrase that gets delivered to a specific cryptographic address.
This method gives the cyber-thieves full control of the victim’s wallet. One who purchases such a Ledger product would be able to move the crypto to their own wallet without accessing the original recovery phrase by using the phrase on the infected wallet. Essentially, this is a form of an offline attack, and one that involves hardware modification.
According to The Coin Republic, Specter, an investigative researcher, tracked transactions made from hundreds of Bitcoin, Ethereum, and TRON wallets.
Ledger was not responsible for confirming either the amounts of the alleged crypto thefts or those responsible for committing this cybercrime at this junction.
Ledger reportedly instructed CryptoBilis to halt sales and shipments of its wallets till the matter was resolved and issued recommendations to those who purchased its products within the past 90 days.
The post Binance Founder CZ Flags NDA Twist in $80M+ Ledger Wallet Hack appeared first on The Coin Republic.
