Tampered Ledger wallets cost Singapore users $2.7M, police say

Key points

• Police say at least two tampered Ledger wallet cases were reported in Singapore since Sept. 10
• Combined losses are about S$3.5 million, or roughly $2.7 million, per Cointelegraph
• Police say wallets from some retail stores had malicious hardware that could capture keys
• Ledger asked retailers in seven Asian markets to suspend sales on Oct. 13

Singapore police said on Oct. 28 that at least two cases involving tampered Ledger hardware wallets have been reported since Sept. 10, with combined losses of about S$3.5 million, or roughly $2.7 million, according to Cointelegraph. The earliest local reports came almost a month before the wider Ledger incident became public on Oct. 9.

What the police advisory says

In an advisory issued by the Singapore Police Force’s Public Affairs Department, police said Ledger wallets bought from some retail stores in Singapore reportedly contained malicious hardware components. According to the advisory, those components could capture a user’s recovery phrase or private keys, allowing unauthorized people to move assets without the owner’s knowledge.

Police said they are in contact with Ledger, which is reviewing the cases, and that investigations are ongoing. The advisory did not name the retailers involved.

The police urged owners of hardware wallets to check official advisories from their wallet provider. Anyone who suspects a device has been tampered with should stop using it, avoid entering a recovery phrase or making transactions on it, and contact the provider through official support channels. If a recovery phrase or keys may be exposed, police said, users should consider moving remaining assets to a new wallet with a newly generated recovery phrase, using an uncompromised device.

Police also warned people never to share private keys or recovery phrases with anyone, including those claiming to represent wallet providers, exchanges or law enforcement, and to be wary of unsolicited offers of wallet verification or recovery help.

How the wider Ledger incident unfolded

Cointelegraph reported that the broader episode surfaced after reports of losses involving devices sold through CryptoBilis, an authorized Ledger reseller serving Indonesia, Malaysia and the Philippines. Mark Karpelès, the former CEO of Mt. Gox, said a Ledger Flex he bought at Singapore’s airport contained a spy implant. Another Ledger user said a device bought from the local IT retailer Challenger had been tampered with, and that Ledger later sent him a replacement. Cointelegraph cited posts on X from both users; it did not independently verify their claims in the report.

On Oct. 13, according to Cointelegraph, Ledger asked retailers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales of its devices while investigations continue.

What happens next for affected users

The police figure covers only the cases reported to authorities in Singapore, and the advisory says losses were about S$3.5 million across at least two cases. Neither the police nor Cointelegraph said how many devices may be affected overall, and the advisory does not say how the components were inserted into the wallets or at what point in the supply chain.

Police are asking anyone with information to call the Police Hotline at 1800-255-0000 or submit details through the force’s online i-Witness portal. People unsure whether an approach is a scam can call the ScamShield helpline at 1799. Ledger’s review of the cases and the police investigation are both continuing.