Justin Sun: Li Lin Once Concealed Due Diligence Materials, I Lent the Company $30 Million to Fill the Gap

Malaysian hardware wallet dealer CryptoBilis has been revealed to have undergone an ownership change prior to the ongoing investigation into suspected supply chain attacks on Ledger devices. Newly disclosed company records show that an individual named Jiaming, with a registered address in Heilongjiang Province, China, has held 100% of the company’s shares since August 3. A former co-founder of CryptoBilis confirmed that the company was acquired in March this year, with original shareholders subsequently stepping down from all operational, management, and administrative roles. He stated that the founding team has been unable to access details of the company’s actual operations since the handover, only continuing to assist with coordinating some activities, and emphasized, “We are no longer part of the company,” urging current management to handle the incident transparently. The ownership change disclosure comes as CryptoBilis faces scrutiny over suspected involvement in the supply chain attack on Ledger hardware wallets, with the devices allegedly implanted with hidden modules to steal recovery phrases. However, there is currently no conclusive evidence linking CryptoBilis’ ownership change to the related wallet breach incident. CryptoBilis has temporarily suspended the sale and shipment of all brands of hardware wallets across all its physical stores and online channels in Malaysia, the Philippines, and Indonesia, and closed its offline stores until further notice.

U.S. President Donald Trump said that thanks to the U.S. military, the U.S. has full control over the Strait of Hormuz, and the volume of oil transported through the strait now even exceeds levels seen before the outbreak of the Iran war. Trump also noted that Russia has agreed to supply large quantities of petroleum products to the U.S., mainly diesel, adding that this is exactly the resource the U.S. currently needs. He simultaneously urged U.S. refiners and retailers to immediately start cutting oil prices, claiming that the U.S. has provided them with ample oil supplies.

In response to the recent Ledger hardware wallet security incident, hardware wallet distributor CryptoBilis issued an announcement stating that it has temporarily suspended sales and shipments of all brands of hardware wallets across all its physical stores and online channels in Malaysia, the Philippines, and Indonesia, and closed its offline locations until further notice. CryptoBilis noted that this move is a preventive measure aimed at protecting its customers. Ledger’s investigation into the incident remains ongoing, and the company will also leverage independent experts to review its business processes. For undelivered orders, CryptoBilis will proactively contact relevant customers; its customer service remains fully operational. The distributor expects to release further updates within 3 working days, and reminded users who have purchased Ledger devices to read both its customer announcement and Ledger’s official security notice, warning them never to disclose their wallet seed phrases or PIN codes, and not to click links that request wallet connection, seed phrase input, or software installation.

SlowMist Security’s Chief Information Security Officer 23pds published an article stating that if the modification of a Ledger device’s printed circuit board (PCB) is exactly as described by former Mt. Gox CEO Mark Karpelès, the attacker would have a very high level of technical proficiency. The attack process would likely unfold as follows: The wallet generates a mnemonic phrase within its Secure Element (SE), then displays it on the screen for the user to copy. The malicious module retrieves the displayed content via screen data lines such as SPI, records the full mnemonic, and transmits the data to the attacker via LTE/eSIM, resulting in the theft of the user’s assets. The Secure Element is designed to prevent direct reading or export of private keys, but cannot block external modules from accessing information shown on the screen. However, this analysis is based on the premise that the PCB was indeed modified in the described manner; the relevant attack path and hardware implantation details remain to be independently verified. BlockBeats reported yesterday that former Mt. Gox CEO Mark Karpelès published a post disclosing that a Ledger hardware wallet he received was suspected to have a spy module implanted. The device originated from Malaysia, its outer packaging shrink wrap was intact, and no abnormalities were immediately apparent after opening; the implant was hidden in the position of the screen’s original cushion. Karpelès further explained that the module includes an LTE communication component, antenna, eSIM, and a microcontroller connected to Ledger’s SPI bus, which can analyze characters displayed to the user and send relevant data once the mnemonic phrase is set up.

The U.S. Commodity Futures Trading Commission (CFTC) on Friday issued an interim final rule and proposed another new rule, seeking to further establish its regulatory authority over prediction markets. Under the new proposal, contracts for sports, political, cultural and weather events traded on platforms like Kalshi and Polymarket will be brought under the existing U.S. swap regulatory framework overseen by the CFTC; casino-style gambling is excluded from the definition of swaps. The two rules differ in legal effect and advancement stage: the interim final rule takes effect immediately but remains open to public comments, while the other rule, which explicitly includes event contracts in the definition of swaps, stays in the proposal stage with a 30-day public comment period. The move comes as the CFTC is embroiled in legal disputes with multiple U.S. states over regulatory authority for prediction markets. The states argue that some sports event contracts are essentially gambling operations subject to state-level gambling regulations, while CFTC Chairman Mike Selig maintains that such contracts are financial derivatives under federal agency jurisdiction. The dispute has been brought before the U.S. Supreme Court, and recent rulings from federal appeals courts have shown splits. The new rules could serve as an important basis for the CFTC to support its regulatory stance in subsequent litigation.

According to EmberCN’s monitoring, addresses linked to SkyAI (SKYA), a Nasdaq-listed SOL treasury firm, transferred out 468,000 SOL over the past 24 hours, worth roughly $51.1 million at current prices. Of the total, 218,000 SOL were sent to multiple centralized exchanges, while another 250,000 SOL went to institutional crypto asset service provider BitGo. SkyAI’s latest filing, released on September 14, showed the company held more than 2 million SOL in reserves at that time. It remains unclear whether this transfer indicates the company is selling SOL, and the related fund flows cannot yet directly confirm it has completed a reduction in its holdings.