Cryptobilis Founder Reveals Company Was Sold Months Before Exploit

Arravind Prabu, founder of Cryptobilis, disclosed that the company had been acquired by an undisclosed party earlier this year. While Prabu acknowledged he assisted the current management team in some events, he denied having any operational visibility into the company’s day-to-day operations.

Cryptobilis Founder Discloses Company Sale, Denies Responsibility for Tampered Devices Exploit

Arravind Prabu, founder of Cryptobilis, the company that allegedly sold the Ledger wallets affected by an ongoing exploit, has provided insight into his involvement with the wallet vendor, distancing himself from the current exploit.

In a statement posted on LinkedIn on October 10, Prabu revealed that Cryptobilis was acquired by undisclosed new ownership, with him and another co-founder stepping down and handing over operational and administrative responsibilities to this new party.

Additionally, Prabu clarified that since the sale was completed, he and the other Cryptobilis co-founder have had “zero access, credentials, visibility, or administrative control over Cryptobilis backend systems, customer databases, order histories, or corporate communication channels.”

Nonetheless, he recognized that they had a role in assisting the new team in some events “in an advisory and coordination capacity” to ensure a smooth transition, but denied having any “business or operational visibility into the company’s day-to-day management or IT infrastructure.”

As for the reason he had not disclosed that the sale had happened, Prabu highlighted that he was contractually bound to hold off on issuing public announcements on the transaction until mid-October, but that all suppliers were notified of the transaction and the shift into new management.

Nonetheless, Prabu did not clarify if Ledger hardware stock was included in the operational handover to the new management, and who had access to these devices before each sale.

“For all active operational matters, technical inquiries, or official statements regarding Cryptobilis, please contact the current lead Person in Charge,” Prabu concluded.

Since Ledger identified a tampered device sourced through Cryptobilis, the company has paused all shipments and sales of Ledger devices, recommending that customers not set up their wallets.

Nonetheless, more tampered devices have reportedly appeared in other regions, sourced from different authorized resellers, expanding the potential scope of this exploit that has already caused over 90 million in losses.

Ledges is still investigating the issue, and in its latest update, it reiterated that all compromised devices were sourced through Cryptobilis.