Arravind Prabu, founder of Cryptobilis, has denied responsibility for an exploit involving tampered devices, saying he had no operational visibility into the company at the time. The disclosure comes after Prabu confirmed that Cryptobilis was sold to an undisclosed party earlier this year, with the acquisition closing months before the exploit occurred.
The sale and the gap that followed
Prabu disclosed that the company had been acquired months before the exploit. The buyer remains undisclosed. In a statement addressing the incident, Prabu acknowledged he assisted the current management team in some events — but stressed that this assistance did not equate to day-to-day involvement.
He denied having any operational visibility into the company's day-to-day operations. That distinction matters. The exploit involved tampered devices, but the facts of how those devices were compromised have not been attributed to any specific party.
What Prabu actually said
Prabu's defense rests on a simple claim: he wasn't running the company when the tampered devices became a problem. He acknowledged assisting the current management team in some events, but denied responsibility for the exploit itself. There's no indication he's pointing fingers elsewhere — just drawing a line between his past role as founder and his present status as someone without operational control.
The gap between "assisted in some events" and "ran the company" is doing a lot of work here. It's a distinction lawyers like. It's also a distinction that users affected by the exploit may find frustrating, given that Prabu's name is still attached to the company he founded.
Why the timing is messy
An acquisition closing months before an exploit is rarely a clean handoff. New management inherits infrastructure, devices, and whatever maintenance debt the previous owner left behind. Prabu says he had no visibility into those operations post-sale. If true, it narrows the window of his responsibility considerably.
But the sale itself — to an undisclosed party — means there's no public entity to scrutinize. No named buyer to answer questions. No regulatory filing to parse, at least not one that's been made public. That absence is itself a problem for anyone trying to figure out who's accountable for the tampered devices.
What's still unresolved
The current management team hasn't publicly responded to Prabu's statement. The undisclosed buyer hasn't been named. And the exploit itself — the mechanism behind the tampered devices — remains unexplained in the facts released so far.
Prabu has drawn his line. Whether the current operators accept that line, or whether affected users push back, is the next thing to watch. For now, the founder is out, the buyer is silent, and the devices are still the center of a question nobody has answered.
