Tampered Ledger Wallets Cost Singapore Users $2.7M as Police Issue Warning
October 30, 2026
Singapore Police Confirm Losses From Tampered Devices
The Ledger hardware wallet scare has reached one of Asia’s most closely watched financial hubs. The Singapore Police Force says at least two cases involving tampered Ledger wallets have been reported since September 10, with combined losses of about S$3.5 million, or roughly $2.7 million. In an advisory published on October 28, police said preliminary investigations found “malicious hardware components” in Ledger wallets bought from some retail stores in Singapore. Those components could capture a user’s recovery phrase or private keys, letting outsiders access the wallet and move the funds inside it. The timing matters. The first Singapore case dates back to September 10, almost a month before the wider incident became public, suggesting the problem was already affecting buyers before anyone warned them.How the Singapore Cases Fit a Wider Pattern
The broader story surfaced on October 9, when users reported losses tied to devices sold through CryptoBilis, an authorized Ledger reseller operating in Indonesia, Malaysia and the Philippines. Days later, Ledger confirmed a hidden hardware implant in at least one affected device. Third-party on-chain researchers estimate losses from the wider incident at $86 million to $93 million across more than 300 wallets on Bitcoin, Ethereum, and Tron, according to CoinDesk. Ledger has not confirmed an official figure. Singapore adds a new layer. The police advisory points to ordinary retail stores rather than a single reseller, and it does not name the shops involved.Airport and High Street Purchases Under Scrutiny
Individual reports had already pointed in this direction. Former Mt. Gox CEO Mark Karpelès said a Ledger Flex he bought at Singapore’s airport contained a spy implant, as reported by Cointelegraph. Another user said a tampered device came from Challenger, a local IT retailer, and that Ledger sent him a replacement unit. On October 13, Ledger asked retailers in seven countries, including Singapore, to suspend sales of its devices while investigations continue.
What a Recovery Phrase Is and Why It Matters
For beginners, this story only makes sense once you understand a recovery phrase. When someone sets up a hardware wallet, the device generates a list of words, usually 24. That list is the wallet’s master key. Anyone holding those words can rebuild the wallet on another device and move every coin inside it, without ever touching the original hardware. That is why hardware wallets are normally considered one of the safer ways to store crypto. The device creates the phrase offline and never lets it touch an internet-connected computer. A tampered device breaks that promise from the start. If a hidden component records the phrase as it is generated, the buyer can follow every instruction correctly and still be exposed from day one. The attacker simply waits, then drains the wallet once funds arrive. It is a supply chain attack: the weak point isn’t the owner’s habits, but the journey the product took before reaching them.What Police Are Telling Users to Do
The advisory sets out clear steps. Anyone who suspects their device has been tampered with should stop using it, avoid entering their recovery phrase on it, and contact the provider only through official support channels. If a recovery phrase or private keys may already be compromised, police advise moving remaining assets to a new wallet with a freshly generated recovery phrase, set up on a device that has not been tampered with. Users are also warned never to share a recovery phrase with anyone, including people claiming to be from a wallet provider, an exchange or law enforcement. That last point matters because high-profile security incidents often attract follow-up scams, with fraudsters posing as support staff offering “wallet verification” or recovery help.What Comes Next for Ledger and Hardware Wallet Buyers
Singapore police say they are in contact with Ledger, which is reviewing the affected cases, and investigations are ongoing. Further cases could surface as more owners check their devices, and the full scale of the retail problem may not be known for some time. For buyers, the lesson so far appears to be about where a device comes from as much as which brand it carries. Hardware wallet makers have long warned buyers against unauthorized sellers. This incident suggests that even a physical shop may not be enough if someone has opened and resealed a device along the way. Hardware wallet makers have been under similar pressure elsewhere, with Keystone deciding to destroy 18,835 devices after hackers stole a device key earlier this week. People comparing a hardware wallet with a mobile digital wallet or other storage options may now weigh supply chain risk alongside the usual questions about convenience and backup.Trust Moves From the Brand to the Box
The Singapore advisory marks a shift in how people will likely judge hardware wallet security. For years, the debate centred on chips, firmware and whether a device could be hacked remotely. These cases show the more practical risk can sit in a cardboard box on a store shelf. When a national police force confirms losses from devices bought over the counter, manufacturers must prove that every unit reaching a buyer is the one that left the factory. Tamper-evident packaging, device authenticity checks and tighter control over resellers may matter as much as the hardware itself. Until that proof is routine, the safest wallet may be the one with the shortest, most traceable path from factory to owner.
Share Article
Madiha Riaz
Madiha is a seasoned researcher in cryptocurrency, blockchain, and emerging Web3 technologies. With a background in organic chemistry and a sharp analytical mindset, she brings scientific depth to decentralized innovation. Since discovering crypto in 2017 and investing in 2018, she’s been uncovering and sharing deep insights into how blockchain is redefining the digital asset landscape.
