THIS month, a Malaysian startup made global headlines over a security breach that may rank as the largest loss in our nation’s financial sector.
CryptoBilis is a popular reseller of hardware wallets used for the self-custody of digital assets. The devices were allegedly tampered with spy chips capable of reading and transmitting access data to hackers before being sold to customers across South-East Asia.
Estimates vary, but around US$102mil was reportedly stolen from more than 300 wallets, including RM12mil from someone in Teluk Intan; far exceeding the Agrobank system exploitation (2025) and MBSB Bank heist (2024).
Netizens were outraged by the company’s lack of transparency leading to the incident. Binance founder Changpeng Zhao blasted on X: “So many things wrong here!”
For victims, their hardest lesson lies in the first response.
During criminal investigations, bank accounts are routinely frozen to prevent suspects from siphoning off money. But what about dollar stablecoins (such as USDT issued by Tether)? Nearly 80% of the loot was placed on the Tron blockchain, mostly in USDT.
Stablecoins can be restrained far more easily than bank balances or cash on hand. Their issuers can blacklist them remotely, burn and reissue them to police-controlled wallets – in just under 45 minutes, by some accounts.
Legally, this is tantamount to freezing, seizure and forfeiture in one fell swoop! That makes the issuer, alongside law enforcement, the victim’s most important ally.
Boost for industry
Early reports indicate that Tether froze about US$10mil across 20 wallets (about 10% of loss) after the thief’s “drain addresses” were identified. The remaining funds were converted into unfreezable tokens.
Modest as that sounds, it is encouraging by industry standards. A Wall Street Journal study spanning the period 2018 to 2024 found that Tether managed to freeze only 0.49% of inbound USDT to blacklisted Tron addresses.
Freezing is a high-speed chase. The mouse often reaches the laundromat before the cat catches up.
One analysis found that the CryptoBilis thief had rehearsed the operation for two weeks and that “most of the money left in the first hour”.
Even with the extraordinary technical advantages of issuers, the window for an effective crypto freeze is measured in minutes or hours, not days.
Look closer, and it’s down to real-time intelligence.
As luck would have it, independent on-chain researchers had detected suspicious flows, which led to rapid intervention by private security firms, and coordination with local authorities.
Intense public interest also helped propel the case, which directly affects the world’s largest hardware wallet provider.
In industry practice, voluntary freezes are increasingly carried out in response to extrajudicial or emergency police requests before a court ever reviews the case.
Pragmatists call this: “freeze first, legalise later”.
Say what you will, but waiting for due process would have taken too long for a complex probe of this nature: a global supply chain attack with Malaysia as ground zero.
Local precedents are mixed. Under Section 53 of the Anti-Money Laundering Act, a prohibition order may be served over foreign property; prosecutors used this route to recover from the Malaysian perpetrators of the Bitkingdom scam (2015-2017), which claimed 500,000 followers at its peak.
But their ill-gotten bitcoins had been proactively frozen by a custodian in the Cayman Islands prior to this.
In one civil case (Sim Kwang Kai vs Johnathon Wong), the claimant sought a Mareva injunction over RM3.2mil worth of USDT described as “assets within the jurisdiction”. The High Court refused the application because he failed to establish a real risk of dissipation.
Foreign issuers may not always cooperate either. Some have refused, claiming that it is technically unfeasible despite the code indicating otherwise.
Even when stablecoins are held by regulated local Digital Asset Custodians (DACs), the crucial fact remains – the issuer controls the kill switch.
The gatekeeper
A DAC can merely act as the gatekeeper by blocking wallet access and suspending withdrawals.
But the issuer, which isn’t a DAC, can surgically freeze stablecoins at the ‘smart contract’ level without impacting other digital assets in the same wallet – DAC can’t override this.
This sharpens the debate: How does an issuer (based in El Salvador like Tether) have the unilateral right to freeze stablecoins circulating in our secondary market, when it neither owns nor holds them in Malaysian custody?
On what legal basis can an issuer interfere with third party assets, even with law enforcement’s behest? And when jurisdictions make conflicting orders, who prevails? The issuer decides?
We’ve accepted this new reality when we chose “private money” (stablecoins) over “sovereign money” (fiat). It is a Faustian bargain: legal norms will be bypassed, novel disputes will crop up, and we cannot wish the uncertainty away.
So, before pointing the finger at regulators to fix this, we should look in the mirror and fully own the consequences of self-custody.
Those who prefer to sleep soundly at night can always keep their money in a bank. Just saying.
Edmund Yong is a director of the Generative AI Association of Malaysia and ambassador of the Global Blockchain Business Council founded in Davos. The views expressed here are the writer’s own.
