Singapore police say malicious components in some retail-channel Ledger wallets caused losses of about S$3.5 million
Singapore police said in a notice released on 2026-10-28 that, since 2026-09-10, they had received at least two cases in which the parties involved suffered total losses of about S$3.5 million after buying Ledger hardware wallets through some retail channels in Singapore. Preliminary investigations showed that some Ledger devices sold by local retailers contained malicious hardware components that could capture users’ recovery phrases or private keys, and then transfer crypto assets without the users’ knowledge.
The police are in contact with Ledger, which is headquartered in Paris, France, and the company is reviewing the relevant cases. The police investigation is still ongoing, and the specific retail stores involved and how the malicious components entered the supply chain have not been disclosed. Ledger had previously confirmed that at least one device sold through Southeast Asian reseller CryptoBilis contained unauthorized hardware implants, and on 2026-10-13 asked retailers and resellers in multiple markets, including Singapore, to suspend sales.
The police advised users to follow the official security guidance for hardware wallets and not to enter recovery phrases on devices suspected of being tampered with or continue transacting on them; if they suspect that a recovery phrase or private key has been exposed, they should use an unaffected device to transfer the remaining assets to a new wallet and regenerate the recovery phrase, and they should never disclose their private key or recovery phrase to anyone.
Original sources:
Title: Police Advisory On Tampered Cryptocurrency Hardware Wallets Publisher: Singapore Police Force Publication date: 2026-10-28 URL: https://www.police.gov.sg/Media-Hub/News/2026/10/20261028_police_advisory_on_tampered_cryptocurrency_hardware_wallets Nature of source: official notice Verification status: full text actually read in this report, verification date 2026-10-29 Supported content: at least two cases since 2026-09-10, with total losses of about S$3.5 million; Ledger devices purchased through some Singapore retail channels contained malicious hardware components that could capture recovery phrases or private keys; police contacted Ledger, investigation ongoing; related security advice
Title: Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis Publisher: Ledger Support (@Ledger_Support) Publication date: 2026-10-09 URL: https://x.com/Ledger_Support/status/2108551100613714002 Nature of source: original post by the party involved Verification status: full text actually read in this report, verification date 2026-10-29 Supported content: Ledger is investigating reports of fund losses involving devices purchased in Southeast Asia through CryptoBilis and asked the reseller to suspend sales and shipments (this does not prove a direct link between the Singapore retail-channel cases and CryptoBilis)
ABAB AI Insight
Ledger is a hardware wallet manufacturer based in Paris, France, and its core security claim is offline private-key storage, with users needing to generate or enter a recovery phrase on the device. This Singapore police notice extends the issue from a single reseller to local physical retail channels: devices were implanted with malicious components after leaving the manufacturer and before reaching end users. Ledger had previously confirmed that at least one device sold through CryptoBilis contained unauthorized implants, which third-party analysis said could read the recovery phrase displayed on the screen during setup and exfiltrate it over a cellular network without altering the secure element itself.
In terms of capital and business pathways, hardware wallets rely on authorized resellers and retail networks to expand coverage, but manufacturers have limited control over end-of-shelf inventory. Ledger has asked retailers and resellers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend sales, and said its own systems and direct-sales channels were not affected. The specific stores and implant stage in the Singapore cases have not been disclosed, so it is not possible to confirm whether the same batch of implants flowed in through different channels or whether they were separate tampering incidents. User losses occurred after entering the recovery phrase, and asset transfers no longer needed to pass through the compromised device.
Comparable cases include past supply-chain or physical tampering attempts against hardware wallets, as well as software-level phishing attacks. Software phishing depends on users actively entering the phrase into a fake page, whereas this case involved the device itself being physically modified after leaving the factory, with users exposing their keys by following the official procedure. Unlike pure software attacks, the tampering occurred before purchase, and the implant could exfiltrate data independently over a cellular network without needing to connect to the user’s computer or phone. Verification methods such as Ledger’s Genuine Check cannot detect this type of physical modification that preserves the original secure element.
This incident changes the premise that a cold wallet is safe simply because it is offline: the security boundary extends from the device chip to the entire retail and distribution chain. For users, devices bought from non-official channels or retail shelves require extra verification; for Ledger, the authorized reseller system has become an attack surface, and suspending sales is a short-term containment measure, while long-term supply-chain auditing and end-to-end verifiability are needed. Indicators to watch are whether the police disclose the involved stores or implant source, and whether Ledger releases more confirmed affected batches or channels.
ABAB News · Cognition Law
The security promise of a hardware wallet ends at the factory; devices on retail shelves can still be implanted and resold.
Once a recovery phrase is read off the screen and exfiltrated during setup, later transfers no longer require contact with the compromised device.
Unimpacted official channels and direct sales do not mean inventory on authorized reseller shelves is equally safe.