CryptoBilis

Arravind Prabu and Vimal Selvamany co-founded Fetch International in 2019, the company under which CryptoBilis was later operated. By early 2021, Fetch International was an 11-person team that had built its own cryptocurrency payment gateway, crypto gift cards and crypto wallets.⁠[1]

In December 2020, Arravind Prabu, Vimal Selvamany and Dhivager Rathakrishnan decided to create CryptoBilis, a crypto merchandise and commerce store selling crypto-themed caps, T-shirts, clocks, art, pillows, mugs, stickers and related books, and acting as an authorized reseller of Ledger SASLedger (Hardware Wallet Company)Ledger is a crypto-asset hardware wallet company headquartered in Paris, France, founded in 2014 by eight people including Eric Larchevêque. It is known for its secure-chip-based Ledger Nano hardware wallets and also offers the Ledger Wallet app (formerly Ledger Live) and Ledger Enterprise services for institutions. It is one of the largest hardware wallet makers and has been through security incidents including a 2020 customer data breach, the 2023 Connect Kit supply-chain attack, and the 2026 discovery of spying hardware implanted in devices sold through resellers.Open the full entry hardware wallets.⁠[1]

Customers could pay in fiat through SenangPay and Billplz, or in Bitcoin, Ethereum, Litecoin and XRP through the in-house gateway Fetchpay; crypto payments were routed to a liquidity provider and converted instantly into Malaysian ringgit via the Luno exchange to limit exposure to price swings.⁠[1]

In March 2021, the company said that almost 30% of its purchases were paid in cryptocurrency, that crypto payments had grown nearly 10% month on month over the previous three months, that sales had reached about RM30,000, and that it planned to support more than 40 cryptocurrencies, including stablecoins, and to launch a product line for larger holders.⁠[1]

On May 27, 2022, CryptoBilis held “Bitcoin Pizza Day 2022” with Tokenize Xchange and Cryptocurrency Malaysia at Brick Studios in Sunway Damansara, Petaling Jaya, Selangor, with attendance capped at 300. The press release named the operator as CB International Sdn Bhd, with an address in Kelana Jaya, Petaling Jaya.⁠[2][3]

In Indonesia, CryptoBilis operated under the name PT Crypto Bilis Indonesia; its Tokopedia store has been recorded as active since May 2022, and it listed an address in Kemayoran, North Jakarta. CryptoBilis Indonesia presented itself on Instagram as an official hardware-wallet reseller in the country.⁠[4]

In 2023, CryptoBilis held Bitcoin Pizza Day at Sentul Depot in Kuala Lumpur; the company said the event gathered about 700 local cryptocurrency and Bitcoin enthusiasts.⁠[3]

On May 24, 2024, CryptoBilis held “Bitcoin Pizza Day 2024” with Satoshi Labs and Trezor at Brooklyn Warehouse in Sampaloc, Manila, drawing about 500 crypto enthusiasts; Mike Biag was then the lead of CryptoBilis Philippines.⁠[5][6]

On May 31 of the same year, the company held Bitcoin Pizza Day at Glasshouse at Seputeh in Kuala Lumpur, and said it had organized the event in Malaysia for three consecutive years.⁠[3]

Effective January 1, 2025, CryptoBilis acquired Isawwwshop, a Philippine online seller of cryptocurrency hardware wallets active on Lazada and Shopee, whose Facebook page was merged into CryptoBilis Philippines’ page. Co-founder and chief executive Arravind Prabu said the acquisition would expand the company’s reach in the Philippines; Isawwwshop founder Al Yap said joining CryptoBilis let the company become part of a larger community.⁠[6]

The CryptoBilis Philippines website at the time listed its leadership as CEO and co-founder Arravind Prabu, chief operating officer Gamaliel Torres and president Michael Biag, and said the company carried more than 20 hardware-wallet brands.⁠[7]

On May 30, 2025, CryptoBilis and hardware-wallet maker Tangem co-hosted “Bitcoin Pizza Day 2025” at MetroTent in Ortigas, Manila.⁠[8]

In October 2025, CEO Arravind Prabu and regional project manager Zean Wong represented CryptoBilis at Ledger’s global launch of Ledger Op3n and Nano Gen5 in Paris; the company described itself as an official distribution partner for Ledger in the Southeast Asian market, with the release datelined Kuala Lumpur, Manila and Jakarta. The company website also says it attended the Trezor Safe 7 launch in Prague.⁠[9][10]

Former CEO Arravind Prabu later said that CryptoBilis had been acquired by new owners in early 2026, and he and co-founder Vimalatheethan handed over all operational, management and administrative responsibilities to the new team in March 2026; he said the acquisition agreement required the deal not to be announced publicly until mid-October 2026.⁠[11][12]

Corporate records show CryptoBilis’s sole shareholder registered in Heilongjiang province, China; the share transfer was finalized in August 2026. No public evidence ties the ownership change to the subsequent thefts.⁠[13][14]

On October 9, 2026, users in Southeast Asia began reporting lost funds. Ledger said that day it was investigating reports of fund losses from users in Southeast Asia, had asked CryptoBilis to pause all sales and shipments of Ledger devices, and advised users who had bought from the reseller in the previous 90 days not to set up their devices, and those who had to move assets to a new device with a new recovery phrase. At the time CryptoBilis was listed as an authorized Ledger reseller in Indonesia, Malaysia and the Philippines.⁠[15][16]

CryptoBilis then issued a notice suspending sales and shipments of all hardware-wallet brands across its online and physical channels until the investigation concluded; a sign dated October 10 said its physical stores were “temporarily closed until further notice.”⁠[14][17][16]

On October 10, Ledger said one affected user’s device contained an unauthorized hardware implant; on October 11 it said a “limited” number of devices was affected and that all confirmed cases involved devices sold through CryptoBilis. On October 13, Ledger’s Donjon security team confirmed that devices sold by CryptoBilis contained unauthorized LTE implants that captured the recovery phrase during setup and transmitted it.⁠[18][17][19]

Trezor subsequently removed CryptoBilis from its reseller list as a precaution while saying it had no reports of tampered devices from CryptoBilis, and OneKey said it had revoked CryptoBilis’s reseller authorization.⁠[19]

Blockchain analysts’ loss estimates ranged from more than US$72 million to US$94.5 million: analyst tanuki42 put losses above US$72 million, Specter above US$86 million, Bitquery traced US$93.2 million from 315 wallets, and YFarmX reported US$94.5 million from 521 addresses. Tether froze about US$10 million in USDT linked to the thefts. Ledger said figures circulating online came from third parties and had not been verified by the company, and it did not confirm the total number of affected users.⁠[15][20][19]

Arravind Prabu issued a statement on behalf of himself and Vimalatheethan denying any link to the sale of tampered Ledger devices. He said that since the handover the two had held “zero access, credentials, visibility, or administrative control” over CryptoBilis’s backend systems, customer databases, order records and corporate communication channels, and that after the acquisition they had given only limited advisory and event-coordination support, without visibility into day-to-day management or IT infrastructure.⁠[18][11][13]

The statement said all suppliers had been notified of the ownership change and that the two were willing to provide information to Ledger to help the investigation, and it referred current administrative inquiries about CryptoBilis to the company’s new person in charge, Nicholas Chang.⁠[12][11]

On October 15, 2026, Ledger wrote that a “highly organized criminal group” had spent months buying genuine Ledger devices, opening them, fitting custom-built hidden components and putting them back into distribution through resellers in Southeast Asia; Ledger said there was no flaw in its chip, operating system or servers, that it was working with law enforcement, and that it had asked authorized resellers and distributors in Southeast Asia and Hong Kong to suspend sales.⁠[21]

As of late October 2026, Ledger said it was conducting an investigation, including engagement with local law enforcement, to determine who tampered with the devices; CryptoBilis’s Kuala Lumpur stores had shut.⁠[16][17][13]

CryptoBilis: Official website: https://www.cryptobilis.com/ (opens in a new window)⁠[10]

CryptoBilis Philippines: Official website: https://www.cryptobilis.com.ph/ (opens in a new window)⁠[7]

X: Official account: https://x.com/cryptobilis (opens in a new window)⁠[10]